The Agentic Threat Model
Every chapter so far has built a control and justified it by a problem. This one does the converse: it names the adversary, systematically. An agentic platform has a larger and stranger attack surface than a chat application, because the model does not merely answer — it plans, calls tools, remembers, and coordinates with other agents and with people. Before the trust controls that follow (identity, guardrails, governance), it is worth mapping the threats they exist to stop, using the vocabulary the field has converged on: the OWASP Top 10 for LLM Applications, and above it the OWASP Top 10 for Agentic Applications.
14.1 Why autonomy widens the attack surface
From first principles, four properties of an agent each open a class of risk a single model call does not have. Autonomy: the model chooses the next action, so an attacker who can influence its reasoning redirects what the system does, not merely what it says. Tool access: actions have real-world side effects — files written, money moved, messages sent — so a manipulated decision becomes a manipulated action. Persistent memory: what the agent learns is stored and reused, so one poisoned input can bias behaviour long after a human would have forgotten it. Multi-agent and human interaction: agents trust other agents and the people steering them, and trust is exploitable. The single-inference threat model — crafted prompt in, bad output out — is still present and still necessary, but it is the floor, not the ceiling. The agentic surface sits on top of it, which is why this platform needs both lenses below.
14.2 The single-inference surface: OWASP LLM Top 10
The OWASP Top 10 for LLM Applications (2025) catalogues the risks of the model and its immediate context — the surface every LLM feature has, agentic or not. These do not vanish when you add autonomy; they become the substrate an attacker uses to reach the agentic risks. The platform already answers each of them in an earlier or later layer, summarized in Table 14.1.
| Risk | What it is | Addressed in |
|---|---|---|
| LLM01 Prompt Injection | Crafted input — direct, or hidden in retrieved/tool content — overrides intended instructions | Guardrails & the trifecta (Ch. 16); context engineering (Ch. 7) |
| LLM02 Sensitive Info Disclosure | Model reveals secrets, PII, or proprietary data in its output | Output/egress filtering (Ch. 16); residency & retention (Ch. 27); secrets (Ch. 15) |
| LLM03 Supply Chain | Compromised models, datasets, plugins, or dependencies | Pinned MCP registry (Ch. 22); model provenance & lifecycle (Ch. 28) |
| LLM04 Data & Model Poisoning | Tampered training, tuning, or retrieval data skews behaviour | Data lineage (Ch. 27); retrieval quality (Ch. 11); model lifecycle (Ch. 28) |
| LLM05 Improper Output Handling | Unsafe downstream use of output — executed or rendered unescaped | Output guardrails (Ch. 16); guarded streaming to the UI (Ch. 13) |
| LLM06 Excessive Agency | Too much permission, autonomy, or tool reach | Least-privilege & agent identity (Ch. 15); MCP control plane (Ch. 22); approval (Ch. 5) |
| LLM07 System Prompt Leakage | Disclosure of system-prompt contents an attacker can exploit | Guardrails (Ch. 16); context engineering (Ch. 7) |
| LLM08 Vector & Embedding Weak. | Attacks on RAG stores — poisoning, inversion, cross-tenant leakage | Retrieval design (Ch. 11); memory (Ch. 10); tenant isolation (Ch. 26) |
| LLM09 Misinformation | Confident, wrong, or fabricated output that is relied upon | Evaluation (Ch. 19); retrieval grounding (Ch. 11) |
| LLM10 Unbounded Consumption | Uncontrolled resource use — cost, denial of service, model extraction | Budgets & iteration ceiling (Ch. 20, 2); rate limits (Ch. 21); noisy-neighbour (Ch. 26) |
14.3 The agentic surface: OWASP Agentic Top 10 (ASI)
The OWASP Top 10 for Agentic Applications (2026) is the agent-specific layer. It uses the ASI prefix and ranks the risks that emerge only once a system reasons, acts, remembers, and coordinates autonomously — drawn from incidents observed in production, not theory. Read structurally, they cluster onto the architecture: goal hijack, privilege abuse, cascading failure, and rogue behaviour strike the reasoning core; tool misuse and code execution strike the tool boundary; supply-chain risk enters at the tool/skill registry; poisoning targets the memory store; spoofing targets inter-agent messaging; and trust exploitation targets the human at the interaction surface. Figure 14.2 maps each to where it first bites, and Table 14.2 maps each to the control that answers it.
| Risk | What it is | Addressed in |
|---|---|---|
| ASI01 Agent Goal Hijack | Attacker redirects the agent's objective via injected instructions, poisoned content, or manipulated tool output | Guardrails & the trifecta (Ch. 16); reasoning/context (Ch. 7); red-teaming (Ch. 19) |
| ASI02 Tool Misuse | Agent induced to misuse legitimate tools — unsafe chaining, parameter injection, manipulated results | MCP control plane & tool allow-listing (Ch. 22); guardrails (Ch. 16); sandboxing (Ch. 9) |
| ASI03 Identity & Privilege Abuse | Inherited credentials, delegated trust, or agent-to-agent trust exploited to act beyond scope | Identity, least-privilege & agent identity (Ch. 15); MCP authorization (Ch. 22); tenant isolation (Ch. 26) |
| ASI04 Agentic Supply Chain | Malicious or tampered tools, descriptors, models, or agent personas enter at runtime | Pinned MCP registry (Ch. 22); model & data provenance (Ch. 27, 28) |
| ASI05 Unexpected Code Execution | Agent-generated or agent-invoked code runs attacker-controlled logic or escapes its sandbox | Sandboxed execution (Ch. 9); the sandbox fleet (Ch. 24) |
| ASI06 Memory & Context Poisoning | Corrupted memory, embeddings, or shared context biases future reasoning long after the input | Provenance-carrying, ontology-grounded memory (Ch. 10, §10.4); grounding (Ch. 11); lineage (Ch. 27) |
| ASI07 Insecure Inter-Agent Comms | Spoofed, intercepted, or poisoned agent-to-agent messages misdirect a cluster | A2A design (Ch. 12); mTLS & identity in the mesh (Ch. 23); agent identity (Ch. 15) |
| ASI08 Cascading Failures | A compromise or error in one agent amplifies across systems — blast-radius effects | Blast-radius limits, bulkheads & DR (Ch. 29); circuit breakers (Ch. 21); budget ceilings (Ch. 20) |
| ASI09 Human-Agent Trust Exploit. | Manipulating the human — decision fatigue, deceptive disclosure, over-trust of agent output | Legible disclosure in AG-UI (Ch. 13); human-in-the-loop gates (Ch. 5); guardrails (Ch. 16) |
| ASI10 Rogue Agents | A compromised or misaligned agent diverges from its intended behaviour | Red-teaming (Ch. 19); guardrails & kill-switch policy (Ch. 16, 17); anomaly detection (Ch. 18) |
14.4 From threat to control: the coverage discipline
A threat model earns its keep only if every threat traces to a control. The two tables do exactly that, and the encouraging result is that the architecture — built bottom-up from first principles — already covers the catalogue. The pattern is worth seeing. The identity-centric risks (ASI03, LLM06) converge on least-privilege and agent identity (Ch. 15) and the MCP control plane (Ch. 22) — which is why OWASP's own framing puts identity at the centre of agentic security. Injection and goal manipulation (ASI01, LLM01) land on the guardrails and the broken trifecta (Ch. 16). Memory poisoning (ASI06) is exactly what the provenance-carrying memory of §10.4 defends. Supply-chain risk (ASI04, LLM03) is why the registry pins vetted servers (Ch. 22) and the model carries provenance (Ch. 28). The lesson is not that the controls are new — most were derived chapters ago — but that a named, ranked threat model lets you audit coverage against an external standard rather than your own assumptions, and surfaces where a control is thin.
14.5 Threat modeling as practice, and the broader frameworks
A list is a checklist; threat modeling is the activity of applying it to your design. The OWASP Agentic initiative pairs its Top 10 with MAESTRO, a layered method for modeling an agentic system's threats across its stack; MITRE ATLAS catalogues real-world attack techniques against AI systems; and the governance frameworks — the NIST AI Risk Management Framework, ISO 42001, and the EU AI Act's risk tiers (Ch. 17) — wrap the technical threats in an accountability and compliance structure. Use the Top 10s to check coverage, MAESTRO to model your own architecture, ATLAS to stay current on techniques, and the governance frameworks to make the result auditable. And operationalize all of it: the adversarial evaluation and red-teaming of Ch. 19 is how the threat model stays true over time — every threat that matters becomes a permanent test, and the attack-success rate becomes a number you drive toward zero.
A control without a threat is speculation; a threat without a control is an incident waiting to happen. Enumerate the agentic attack surface using the OWASP LLM and Agentic Top 10s, map every entry to a control in the platform, and treat any unmapped threat as a gap to close. The single-inference risks are the floor; the agentic risks — goal hijack, tool misuse, privilege abuse, memory poisoning, rogue agents — are what autonomy adds on top.
"We told the model not to" is not a control (Ch. 16, 30). The model is the thing being attacked — through its prompt, its tools, its memory, and its peers — so the boundary must live in the deterministic platform around it: least-privilege identity (Ch. 15), policy enforcement and tool allow-listing (Ch. 16, 22), provenance on memory (Ch. 10), and an audit trail that makes every action attributable (Ch. 17). Treating prompt instructions as a security perimeter reopens the entire OWASP catalogue at once.