agentic-security-threat-modeling by anshumanbh

---
name: agentic-security-threat-modeling
description: Identify agentic AI security threats based on OWASP Top 10 for Agentic Applications 2026. Use when analyzing AI agents, LLM-powered applications, chatbots, auto-reply systems, tool-using AI, browser automation, sandbox execution, or any application that uses AI/LLM APIs (Anthropic, OpenAI, Claude, GPT) to process user input and take actions.
allowed-tools: Read, Grep, Glob, Write
---

# Agentic Security Threat Modeling Skill

## Purpose
Augment generic STRIDE threat modeling with agentic AI-specific threats from OWASP Top 10 for Agentic Applications 2026. This skill identifies security risks unique to autonomous AI agents, multi-agent systems, and LLM-powered applications.

## When to Use This Skill

**IMPORTANT**: Activate this skill when the codebase contains ANY of these patterns. This includes both standard frameworks AND custom agent implementations.

### Agent Framework Indicators
- `langchain` imports or dependencies
- `autogen` imports or dependencies
- `crewai` imports or dependencies
- `claude_agent_sdk` or `claude-agent-sdk` usage
- `openai.beta.assistants` or OpenAI Assistants API
- `semantic_kernel` imports
- `llama_index` with agent patterns

### LLM/AI API Usage (Custom Implementations)
- `anthropic` or `@anthropic-ai/sdk` imports (Claude API)
- `openai` imports (OpenAI/GPT API)
- `Anthropic(` or `OpenAI(` client instantiation
- `messages.create`, `chat.completions.create` API calls
- Any code calling Claude, GPT, or other LLM APIs

### Custom Agent Patterns (Non-Framework)
- Files or directories named `agent`, `agents`, `runner`, `executor`
- Classes with `Agent`, `Runner`, `Executor`, `Bot`, `Assistant` in name
- Tool execution code (`bash-tools`, `browser-tools`, `tool-use`)
- Sandbox/container execution for AI (`sandbox`, `isolated`, `container`)
- Auto-reply or chatbot systems (`auto-reply`, `reply`, `bot`, `chatbot`)

### Agentic Code Patterns
- Tool/function definitions for LLMs (`@tool`, `tools=[]`, `tools:`, function calling)
- Agent class definitions (`class.*Agent`, `BaseAgent`, `.*Runner`, `.*Executor`)
- Multi-agent communication (`agent.send`, `agent.receive`, inter-agent messaging)
- Memory/context management (`memory`, `context`, `ConversationBuffer`, `session`, `transcript`)
- RAG implementations (`retriever`, `VectorStore`, `embedding`)
- Prompt templates with tool instructions (`system_prompt`, `systemPrompt`)
- Agent orchestration (`AgentExecutor`, `run_agent`, `runAgent`, workflow definitions)
- Browser automation for AI (`playwright`, `puppeteer`, `browser-tool`)

### MCP (Model Context Protocol) Patterns
- MCP server implementations
- Tool registration for MCP
- MCP client connections

## Detection Phase

Before generating threats, scan the codebase for agentic patterns using these searches:

```
1. Search for LLM API usage (CRITICAL - catches custom implementations):
   - Grep for: anthropic|openai|claude|gpt-|llm|completion|chat\.create|messages\.create
   
2. Search for framework imports:
   - Grep for: langchain|autogen|crewai|claude_agent_sdk|openai.*assistant|semantic_kernel
   
3. Search for agent/runner/executor patterns:
   - Grep for: agent|runner|executor|bot|assistant (in file/directory names)
   - Grep for: class.*Agent|class.*Runner|class.*Executor|class.*Bot
   
4. Search for tool execution patterns:
   - Grep for: bash.tool|browser.tool|tool.use|tools\s*[:=]|@tool|function.call
   
5. Search for sandbox/isolation patterns:
   - Grep for: sandbox|container|isolated|docker.*run
   
6. Search for auto-reply/chatbot patterns:
   - Grep for: auto.reply|chatbot|bot.reply|message.handler
   
7. Search for memory/session patterns:
   - Grep for: memory|context|session|transcript|conversation
   
8. Search for MCP patterns:
   - Grep for: mcp|MCPServer|MCPClient|tool_registration
```

**If ANY of these patterns are found, proceed with agentic threat modeling using ASI01-ASI10 categories.**

## OWASP Agentic Security Initiative (ASI) Threat Categories

### ASI01: Agent Goal Hijack

**Description**: Attacks that exploit prompt injection to override, modify, or manipulate the intended goal of an AI Agent, diverting activities toward attacker-specified objectives.

**Code Patterns Indicating Risk**:
- User input directly concatenated into prompts
- No input sanitization before LLM processing
- Missing guardrails against instruction override
- Prompts without clear system/user separation

**Threat Template**:
```json
{
  "id": "THREAT-ASI01-XXX",
  "category": "Tampering",
  "title": "Agent Goal Hijack via [injection point]",
  "description": "Attacker can inject malicious instructions through [input source] to override agent's intended goal and execute unauthorized actions",
  "severity": "critical",
  "affected_components": ["[agent component]", "[input handler]"],
  "attack_scenario": "1. Attacker crafts input containing hidden instructions\n2. Input reaches agent without sanitization\n3. Agent interprets injected content as instructions\n4. Agent executes attacker's goal instead of intended task",
  "vulnerability_types": ["CWE-74", "CWE-77"],
  "mitigation": "Implement input sanitization, use structured prompts with clear boundaries, add output validation, implement goal state monitoring",
  "existing_controls": [],
  "control_effectiveness": "none",
  "attack_complexity": "low",
  "likelihood": "high",
  "impact": "critical",
  "risk_score": "critical",
  "residual_risk": "Without input sanitization or prompt boundaries, full goal hijack is possible"
}
```

### ASI02: Tool Misuse and Exploitation

**Description**: Agents misuse legitimate tools due to prompt injection, misalignment, or unsafe delegation, leading to data exfiltration, tool output manipulation, or workflow hijacking.

**Code Patterns Indicating Risk**:
- Tools with broad permissions (file system, network, database)
- No input validation on tool parameters
- Missing rate limits on tool invocations
- Tools that accept URLs or file paths from user input

**Threat Template**:
```json
{
  "id": "THREAT-ASI02-XXX",
  "category": "Tampering",
  "title": "Tool Misuse via [tool name]",
  "description": "Agent can be manipulated to misuse [tool name] for unauthorized [action type]",
  "severity": "high",
  "affected_components": ["[tool]", "[agent executor]"],
  "attack_scenario": "1. Attacker provides input referencing tool capabilities\n2. Agent invokes tool with attacker-controlled parameters\n3. Tool performs unintended action (data exfil, SSRF, etc.)",
  "vulnerability_types": ["CWE-918", "CWE-78", "CWE-22"],
  "mitigation": "Implement least-privilege tool profiles, add input filtering, require human approval for sensitive actions, sandbox tool execution",
  "existing_controls": [],
  "control_effectiveness": "none",
  "attack_complexity": "medium",
  "likelihood": "high",
  "impact": "high",
  "risk_score": "critical",
  "residual_risk": "Tools with broad permissions can be exploited for data exfiltration or lateral movement"
}
```

### ASI03: Identity and Privilege Abuse

**Description**: Exploits dynamic trust and delegation in agents to escalate access by manipulating delegation chains, role inheritance, or cached credentials.

**Code Patterns Indicating Risk**:
- Agents inheriting user credentials or tokens
- Long-lived tokens passed to agents
- No credential scoping per task
- Shared identity across multiple agents
- Missing delegation chain validation

**Threat Template**:
```json
{
  "id": "THREAT-ASI03-XXX",
  "category": "Elevation of Privilege",
  "title": "Privilege Escalation via [delegation mechanism]",
  "description": "Agent inherits excessive privileges through [mechanism], enabling unauthorized access to [resource]",
  "severity": "high",
  "affected_components": ["[agent]", "[auth component]"],
  "attack_scenario": "1. Agent receives broad credentials for convenience\n2. Attacker exploits agent vulnerability\n3. Attacker gains access to all resources agent can access",
  "vulnerability_types": ["CWE-269", "CWE-250", "CWE-266"],
  "mitigation": "Use per-task identities, implement JIT privileges, segment memory, validate delegation chains",
  "existing_controls": [],
  "control_effectiveness": "none",
  "attack_complexity": "medium",
  "likelihood": "medium",
  "impact": "high",
  "risk_score": "high",
  "residual_risk": "Inherited credentials provide lateral movement opportunities if agent is compromised"
}
```

### ASI04: Agentic Supply Chain Vulnerabilities

**Description**: Vulnerabilities from external components—models, plugins, tools, data sources—that are not adequately vetted or monitored.

**Code Patterns Indicating Risk**:
- Third-party MCP servers or plugins
- Unpinned model versions
- External tool registries
- RAG sources from untrusted origins
- Dynamic plugin loading

**Threat Template**:
```json
{
  "id": "THREAT-ASI04-XXX",
  "category": "Tampering",
  "title": "Supply Chain Compromise via [component]",
  "description": "Malicious or compromised [component type] could inject backdoors or exfiltrate data",
  "severity": "high",
  "affected_components": ["[external component]", "[integration point]"],
  "attack_scenario": "1. Attacker compromises third-party [component]\n2. Agent loads/uses compromised component\n3. Malicious code executes in agent context",
  "vulnerability_types": ["CWE-829", "CWE-494", "CWE-1104"],
  "mitigation": "Vet dependencies, pin versions, verify model provenance, use SBOM/AIBOM, scan for vulnerabilities",
  "existing_controls": [],
  "control_effectiveness": "none",
  "attack_complexity": "high",
  "likelihood": "medium",
  "impact": "high",
  "risk_score": "high",
  "residual_risk": "Third-party components may contain backdoors or vulnerabilities not detected by standard scanning"
}
```

### ASI05: Unexpected Code Execution (RCE)

**Description**: Agent executes code not intended by designers, through prompt injection, tool misuse, or insecure code execution features.

**Code Patterns Indicating Risk**:
- `eval()` or `exec()` on LLM output
- Code interpreter tools
- Shell command execution from agent
- Dynamic code generation without sandboxing

**Threat Template**:
```json
{
  "id": "THREAT-ASI05-XXX",
  "category": "Tampering",
  "title": "Remote Code Execution via [execution path]",
  "description": "Agent can be tricked into executing arbitrary code through [mechanism]",
  "severity": "critical",
  "affected_components": ["[code execution component]"],
  "attack_scenario": "1. Attacker crafts input that generates malicious code\n2. Agent passes generated code to execution engine\n3. Malicious code runs with agent's privileges",
  "vulnerability_types": ["CWE-94", "CWE-95", "CWE-78"],
  "mitigation": "Disable unnecessary code execution, sandbox all generated code, validate code before execution, use allowlists",
  "existing_controls": [],
  "control_effectiveness": "none",
  "attack_complexity": "low",
  "likelihood": "high",
  "impact": "critical",
  "risk_score": "critical",
  "residual_risk": "Code execution without sandboxing allows full system compromise"
}
```

### ASI06: Memory & Context Poisoning

**Description**: Attackers corrupt persistent memory, session context, or RAG knowledge base to influence future agent behavior across sessions.

**Code Patterns Indicating Risk**:
- Persistent conversation memory
- RAG with user-contributed content
- Shared context across users/sessions
- No memory validation or expiration

**Threat Template**:
```json
{
  "id": "THREAT-ASI06-XXX",
  "category": "Tampering",
  "title": "Context Poisoning via [memory component]",
  "description": "Attacker can inject malicious content into [memory type] that persists and influences future agent behavior",
  "severity": "high",
  "affected_components": ["[memory/RAG component]"],
  "attack_scenario": "1. Attacker injects crafted content into agent memory\n2. Malicious content persists across sessions\n3. Future interactions influenced by poisoned context",
  "vulnerability_types": ["CWE-472", "CWE-915"],
  "mitigation": "Validate memory inputs, segment by user/tenant, apply TTLs, monitor for anomalies",
  "existing_controls": [],
  "control_effectiveness": "none",
  "attack_complexity": "medium",
  "likelihood": "medium",
  "impact": "high",
  "risk_score": "high",
  "residual_risk": "Poisoned context can influence agent behavior across multiple sessions and users"
}
```

### ASI07: Insecure Inter-Agent Communication

**Description**: Vulnerabilities when agents exchange messages without proper authentication, encryption, or validation.

**Code Patterns Indicating Risk**:
- Agent-to-agent messaging without auth
- Plaintext inter-agent communication
- No message signing or verification
- Open agent discovery/registration

**Threat Template**:
```json
{
  "id": "THREAT-ASI07-XXX",
  "category": "Spoofing",
  "title": "Inter-Agent Message Injection via [communication channel]",
  "description": "Attacker can inject or spoof messages between agents through [channel]",
  "severity": "high",
  "affected_components": ["[agent A]", "[agent B]", "[communication layer]"],
  "attack_scenario": "1. Attacker intercepts/injects inter-agent messages\n2. Receiving agent trusts spoofed message\n3. Agent performs unauthorized action based on fake request",
  "vulnerability_types": ["CWE-290", "CWE-319", "CWE-345"],
  "mitigation": "Use mTLS for agent communication, sign all messages, validate peer identities, encrypt channels",
  "existing_controls": [],
  "control_effectiveness": "none",
  "attack_complexity": "medium",
  "likelihood": "medium",
  "impact": "high",
  "risk_score": "high",
  "residual_risk": "Spoofed inter-agent messages can trigger unauthorized actions across the agent network"
}
```

### ASI08: Cascading Failures

**Description**: Faults in one agent propagate through interconnected systems, amplifying impact and causing widespread disruption.

**Code Patterns Indicating Risk**:
- Tightly coupled agent dependencies
- No circuit breakers or bulkheads
- Shared resources without isolation
- No retry limits or timeouts

**Threat Template**:
```json
{
  "id": "THREAT-ASI08-XXX",
  "category": "Denial of Service",
  "title": "Cascading Failure via [failure point]",
  "description": "Failure in [component] can cascade to [dependent components], causing system-wide disruption",
  "severity": "medium",
  "affected_components": ["[origin component]", "[dependent components]"],
  "attack_scenario": "1. Attacker triggers failure in [component]\n2. Failure propagates to dependent agents\n3. System-wide outage or degradation occurs",
  "vulnerability_types": ["CWE-754", "CWE-400"],
  "mitigation": "Implement circuit breakers, add bulkheads, validate outputs, apply timeouts and rate limits",
  "existing_controls": [],
  "control_effectiveness": "none",
  "attack_complexity": "medium",
  "likelihood": "medium",
  "impact": "medium",
  "risk_score": "medium",
  "residual_risk": "Tightly coupled agents without circuit breakers can cause system-wide outages"
}
```

### ASI09: Human-Agent Trust Exploitation

**Description**: Attackers leverage trust humans place in AI agents to deceive, manipulate, or social-engineer users.

**Code Patterns Indicating Risk**:
- Agent outputs presented as authoritative
- No source attribution on agent responses
- Agent can impersonate users or systems
- Missing confidence indicators

**Threat Template**:
```json
{
  "id": "THREAT-ASI09-XXX",
  "category": "Spoofing",
  "title": "Trust Exploitation via [agent capability]",
  "description": "Agent can be manipulated to present false information authoritatively, misleading users into [harmful action]",
  "severity": "medium",
  "affected_components": ["[agent]", "[user interface]"],
  "attack_scenario": "1. Attacker manipulates agent output\n2. User trusts agent-presented information\n3. User takes harmful action based on false info",
  "vulnerability_types": ["CWE-451"],
  "mitigation": "Add output attribution, show confidence levels, require human review for high-stakes decisions",
  "existing_controls": [],
  "control_effectiveness": "none",
  "attack_complexity": "low",
  "likelihood": "medium",
  "impact": "medium",
  "risk_score": "medium",
  "residual_risk": "Users may act on false information presented authoritatively by the agent"
}
```

### ASI10: Rogue Agents

**Description**: Agents acting outside intended scope due to compromise, misconfiguration, emergent behavior, or malicious design.

**Code Patterns Indicating Risk**:
- No agent behavior monitoring
- Missing kill switches
- No agent registration/inventory
- Agents can spawn sub-agents without limits

**Threat Template**:
```json
{
  "id": "THREAT-ASI10-XXX",
  "category": "Repudiation",
  "title": "Rogue Agent Behavior in [agent]",
  "description": "[Agent] could act outside intended scope due to [cause], performing unauthorized actions without detection",
  "severity": "high",
  "affected_components": ["[agent]"],
  "attack_scenario": "1. Agent behavior drifts from intended scope\n2. Rogue actions go undetected due to missing monitoring\n3. Agent causes damage before intervention",
  "vulnerability_types": ["CWE-778"],
  "mitigation": "Maintain agent inventory, monitor behavior baselines, implement kill switches, use signed artifacts",
  "existing_controls": [],
  "control_effectiveness": "none",
  "attack_complexity": "medium",
  "likelihood": "medium",
  "impact": "high",
  "risk_score": "high",
  "residual_risk": "Without monitoring and kill switches, rogue agent behavior may go undetected"
}
```

## Output Format

Generate additional threats in the same JSON format as the base threat model:

```json
{
  "id": "THREAT-ASI0X-001",
  "category": "[STRIDE category]",
  "title": "[Specific threat title]",
  "description": "[Detailed description]",
  "severity": "critical|high|medium|low",
  "affected_components": ["component1", "component2"],
  "attack_scenario": "[Step-by-step attack]",
  "vulnerability_types": ["CWE-XXX"],
  "mitigation": "[Specific recommendations]",
  "existing_controls": ["[Controls found in codebase]"],
  "control_effectiveness": "none|partial|substantial",
  "attack_complexity": "low|medium|high",
  "likelihood": "low|medium|high",
  "impact": "low|medium|high|critical",
  "risk_score": "low|medium|high|critical",
  "residual_risk": "[Description of remaining risk after existing controls]"
}
```

**ID Convention**: Use `THREAT-ASI0X-NNN` where X is the ASI category number (1-10).

**Risk Assessment Fields**:
- `existing_controls`: List controls found in the codebase (e.g., sandboxing, rate limiting, input validation)
- `control_effectiveness`: How well existing controls mitigate the threat
- `attack_complexity`: Skill level required to exploit (low = script kiddie, high = expert)
- `likelihood`: Probability of exploitation given controls and complexity
- `impact`: Damage if successfully exploited
- `risk_score`: Calculated from likelihood × impact matrix
- `residual_risk`: What risk remains even with existing controls

## Workflow

1. **Detect Agentic Patterns**: Search codebase for framework imports and agent patterns
2. **Identify Components**: Map detected patterns to specific files and components
3. **Apply ASI Categories**: For each component, evaluate all 10 ASI categories
4. **Generate Threats**: Create threats using templates, customized to specific codebase
5. **Prioritize**: Assign severity based on exploitability and impact
6. **Output**: Add threats to THREAT_MODEL.json alongside STRIDE threats

## Examples

See `examples.md` for comprehensive attack scenarios for each ASI category with real-world code patterns.

## References

- [OWASP Top 10 for Agentic Applications 2026](../../../docs/references/OWASP-Top-10-Agentic-Applications-2026.md)
- [OWASP LLM Top 10](https://genai.owasp.org/)
- [Agent Skills Guide](../../../docs/references/AGENT_SKILLS_GUIDE.md)