How is this different from a normal threat model?

The method is the same; the surfaces are new. Classic models assume code executes instructions and data does not. With an agent, data is instructions — so retrieval, memory and tool results all become input channels an attacker can reach.

Do I need one if my agent is read-only?

Yes, a smaller one. A read-only agent still has an exfiltration surface — anything it can read it can be made to repeat — and 'read-only' is a property that has to be enforced at the tool layer, not assumed from the prompt.

Where do I start if I have nothing written?

List the tools the agent can call and the data each one reaches. That single table produces most of the map: capabilities are the blast radius, and the inputs that can reach them are the attack paths.

How often should it be revisited?

Whenever a tool, a data source or an autonomy level changes — those are the events that create surfaces. Model upgrades matter less than people expect; they change likelihood, not reach.

GovernanceUpdated 2026-08-22 · Version 1.0

What is an Agentic Threat Model?

An agentic threat model is the map of how an autonomous agent can be attacked: not through its weights, but through everything it reads, remembers, calls and is allowed to do. It names the surfaces — direct and indirect prompt injection, tool poisoning, excessive agency, memory poisoning, supply chain, exfiltration channels, the confused deputy — so each one gets a control in the harness instead of a hope in the system prompt.

Evidence: Industry observationConfidence: HighSource: Industry observationSource: PaperSource: Personal experience

Machine-readable: JSON

Definition

An agentic threat model is a structured enumeration of the attack surfaces, adversary goals and abuse paths specific to an AI agent — its inputs, context, memory, tools, credentials and autonomy — used to decide which harness controls are required before the agent is given production access.

Key takeaways

Threat-model the agent's actions, not the model's outputs.
Every input the agent reads is an instruction channel: documents, pages, tool results, other agents.
Every tool the agent can call is a capability an attacker inherits the moment an injection succeeds.
Memory turns a one-shot attack into a persistent one.
Blast radius is set by credentials and egress, not by the prompt.
An unnamed surface is not an absent one — write down accepted risks explicitly.

Context

Classic threat modelling asks what an attacker can send to your system. With agents the harder question is what your system will read on its own initiative and treat as instructions. An agent that fetches a page, opens a ticket or reads a tool result has enlarged its trust boundary without anyone deciding to.

The second shift is agency. A chatbot that is fooled produces a wrong sentence; an agent that is fooled makes a call, moves money, deletes a branch or emails a file. The severity of a successful attack is set by the tools and credentials attached to the agent, which is why permissioning is a security decision rather than a convenience one.

Frameworks anchor the exercise: the OWASP Top 10 for LLM Applications names the vulnerability classes and MITRE ATLAS catalogues adversary tactics observed against AI systems. Use them as checklists over your own architecture, not as substitutes for having one.

Architecture

Direct prompt injection — the person talking to the agent tries to override its instructions. Cheapest to attempt and easiest to bound, because that user is already inside whatever permission the session grants.

Indirect prompt injection — instructions hidden in content the agent retrieves: a web page, a PDF, a ticket comment, an email, a source file, another agent's output. The attacker never talks to your agent; they plant text where it will read.

Tool poisoning — a tool whose description or result is itself adversarial. A server can describe a benign tool at approval time and change it afterwards, so trust is checked once and exercised forever.

Excessive agency — the agent holds permissions broader than any single task requires. Nothing has gone wrong yet; the surface is that a hijacked agent instantly inherits everything the harness was willing to grant.

Memory poisoning — false facts or instructions written into persistent memory or a vector store, so the attack survives the session and re-triggers on future, unrelated tasks.

Supply chain — models, system prompts, MCP servers, packages and datasets pulled from outside the organisation. A dependency that can rewrite a tool description is a dependency that can rewrite the agent's behaviour.

Exfiltration channels — any path by which bytes can leave: an outbound fetch, an image URL rendered in a reply, an email or webhook tool, a commit. Data does not need to be read by a human to be stolen; a URL is enough.

Confused deputy — the agent acts with credentials the requester does not have, so an attacker who cannot reach a system directly asks the agent to reach it on their behalf.

Components

Asset inventory: the data, systems and credentials the agent can touch, listed by the agent's reach rather than by the team's org chart.Trust boundaries: which inputs are instructions, which are data, and where that line is enforced in code rather than in prose.Tool catalogue with permissions: every tool, its scope, whether it writes, and what an attacker gains by calling it.Egress map: every way bytes can leave, including the accidental ones — link previews, rendered images, log shipping, error reporting.Adversary goals: exfiltrate, escalate, persist, disrupt, deceive — each mapped onto the surfaces above.Controls with owners: which harness component bounds each path, and who maintains it.Accepted risks: paths deliberately left open, with the reason and the compensating detection.Test cases: for each surface, the injection or abuse attempt that proves the control works. A control never seen failing is a control never verified.

Benefits

It converts 'is our agent safe?' into a finite list of surfaces that each have an owner and a control.
It makes permission decisions explicit and reviewable before production access is granted.
It gives red teams a target list and gives evaluation suites concrete cases to automate.
It ages well: models change often, surfaces change slowly, so the map survives the next model swap.

Risks

Modelling the chatbot and not the agent — enumerating output harms while ignoring the tools that turn them into actions.
Treating the model as the control point. Alignment reduces attempts; it does not bound consequences.
A document written once and never revisited. Every new tool is a new surface, so the model belongs in the change process.
Confusing coverage with defence: naming a surface is not controlling it, and an untested control is a claim.

Tools & technologies

OWASP Top 10 for LLM Applications — shared vocabulary for the vulnerability classes.MITRE ATLAS — adversary tactics and techniques observed against AI systems.NIST AI RMF — the governance frame the map plugs into (Govern, Map, Measure, Manage).Agent traces and audit logs — the evidence layer; without them the model is unfalsifiable.Automated red-team suites — injection corpora run in CI so regressions surface before release.Policy and permission engines — where the conclusions of the model are actually enforced.

Examples

A support agent that reads customer email: the message body is untrusted instruction input, the CRM tool is the capability, and the reply channel is the exfiltration path. Three surfaces from one feature.
A coding agent with repository write access and network egress: injection through a dependency's README, capability through the commit tool, exfiltration through any registry it can reach.
A retrieval agent over an internal wiki: anyone who can edit a page can write instructions the agent will read, which makes a low-privilege internal editor an injection vector.

FAQs

How is this different from a normal threat model?: The method is the same; the surfaces are new. Classic models assume code executes instructions and data does not. With an agent, data is instructions — so retrieval, memory and tool results all become input channels an attacker can reach.
Do I need one if my agent is read-only?: Yes, a smaller one. A read-only agent still has an exfiltration surface — anything it can read it can be made to repeat — and 'read-only' is a property that has to be enforced at the tool layer, not assumed from the prompt.
Where do I start if I have nothing written?: List the tools the agent can call and the data each one reaches. That single table produces most of the map: capabilities are the blast radius, and the inputs that can reach them are the attack paths.
How often should it be revisited?: Whenever a tool, a data source or an autonomy level changes — those are the events that create surfaces. Model upgrades matter less than people expect; they change likelihood, not reach.