AI Agent Threat Modeling Frameworks

The threat modeling canon was built for a different era. STRIDE, PASTA, attack trees drawn on whiteboards in conference rooms that smelled like stale coffee: these tools were designed for systems that stayed where you put them, did what they were told, and waited patiently for a human to make the next decision. AI agents do none of those things. Applying legacy frameworks to agentic systems isn't just a coverage gap; it's a category error. Trying to secure an AI agent with STRIDE is like using a map of Kansas to navigate the ocean: technically a map, wrong kind of terrain entirely.

What STRIDE and PASTA Actually Got Right

STRIDE's six-bucket classification, Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege, is elegant. Teachable in an afternoon, and for static systems with legible trust boundaries, it delivers exactly what it promises. PASTA layered attacker-centric thinking on top of that structural foundation, adding business context and simulation-oriented analysis that made threat modeling feel less like a compliance checkbox and more like an adversarial exercise worth taking seriously.

The shared assumption baked into both frameworks, so deeply embedded it rarely gets named, is that the system under analysis is relatively stable, supervised by humans at meaningful decision points, and operating within a boundary you can draw and agree upon. That assumption held for long enough that nobody had much reason to interrogate it.

Then agents showed up.

What an Agent Actually Does, and Why It Breaks Everything

An AI agent receives a goal. It decomposes that goal into subtasks, selects tools, calls external APIs, retrieves documents, interprets results, revises its plan, and executes the next step, often without a human anywhere in the loop. The threat surface isn't a fixed topology you diagram once and revisit at the next annual review. It shifts at runtime, shaped dynamically by whatever the agent decides to do next.

That single fact invalidates most of what STRIDE was built to do.

STRIDE can tell you that an agent's API calls are vulnerable to spoofing. What it cannot tell you is that the agent itself is vulnerable to manipulation mid-execution through a maliciously crafted document it retrieved entirely on its own initiative, without anyone asking it to, because that's what the task required. It cannot tell you that the agent's reasoning can be subverted through prompt injection buried in third-party content the agent trusted because nothing in its architecture told it not to. And it absolutely cannot tell you that a compromised agent will chain legitimate permissions in sequences no human operator ever imagined, at machine speed, before anyone notices something is wrong.

That's not a flaw in STRIDE. It's a tool being asked to do something it was never designed for. You wouldn't blame a hammer for being bad at driving screws.

PASTA is closer in spirit to what agentic security demands, because attacker simulation is the right instinct. But it still presupposes identifiable human decision points where interventions can occur, stable data flows, reviewable processes. An agent doesn't pause for review. It acts.

The Failure Modes Nobody Wants to Talk About

The Cognition Layer Is the Attack Surface

An agent that browses the web, processes emails, or reads uploaded documents is ingesting untrusted content and mixing it with its instruction context at every step. Adversarial content embedded in that external material can hijack the agent's goals, redirect its tool usage, or exfiltrate data through channels the agent itself controls. This is prompt injection, and it has no meaningful analogue in a STRIDE threat tree. The vulnerability lives in the cognition layer, not the communication layer, which is precisely why frameworks designed around communication pathways miss it entirely.

Security teams will spend three hours walking a data flow diagram, correctly identify every spoofable API endpoint, and never once ask what happens when the agent reads a PDF someone emailed it. The PDF is the attack surface. The agent is the delivery mechanism. Traditional frameworks give you no vocabulary for that, so the question doesn't get asked, and then something goes wrong, and everyone looks confused.

Agents Arrive Pre-Loaded

Agents are frequently provisioned with credentials, API keys, and access tokens that reflect their potential operational scope rather than their immediate task requirements. At runtime, they use a fraction of that access. But if an agent is compromised or manipulated, the entirety of its provisioned access becomes immediately actionable, at machine speed, without the friction of human hesitation or the latency of credential acquisition.

Traditional privilege escalation models assume an attacker who must work to accumulate access over time, pushing against the boundary, looking for cracks. An agent arrives pre-loaded. The attacker doesn't need to escalate; they just need to redirect.

The Invisible Pipeline

Modern agentic architectures increasingly involve orchestrator agents that decompose tasks and dispatch sub-agents — each potentially operating with different permissions, interacting with different systems, and holding different trust relationships with external services. Those inter-agent trust relationships are rarely formally modeled. An adversary who can influence an orchestrator, or impersonate a sub-agent's response, can corrupt an entire pipeline without ever touching a surface that shows up in a conventional threat model. STRIDE addresses privilege escalation between users and systems. It has nothing to say about inter-agent authority delegation because that concept didn't exist when STRIDE was designed.

The Staleness Problem Is Worse Than You Think

Security practitioners have always understood that threat models drift from reality after deployment. What's new with agentic systems is the speed of the drift. A static application's behavior is analyzable in advance. An agent's behavior is partly a function of what it encounters during execution, which is the whole point of building agents. A threat model filed in SharePoint the day the agent goes live is categorically inadequate for a system that generates its own execution paths in real time.

MAESTRO and Why It's the Right Starting Point

MAESTRO (Multi-Agent Environment, Security Threats, Risks, and Objectives) is among the more coherent purpose-built frameworks for this problem. Where STRIDE categorizes threats by type and PASTA organizes around attacker motivation, MAESTRO structures analysis around the layered architecture of agentic systems themselves.

The framework decomposes the agentic stack into discrete layers: the foundation model, the agent runtime, the tool and resource access layer, the multi-agent interaction layer, and the deployment environment. Threats are analyzed within and across those layers, which matters because the most dangerous attack patterns in agentic systems are cross-layer by nature. Prompt injection enters at the data ingestion layer, manifests as corrupted behavior at the planning layer, and propagates to the tool execution layer. A single-layer threat model sees none of that cascade.

The operational value isn't really the taxonomy. It's the analytical discipline MAESTRO imposes. It requires practitioners to model the agent's goal structure and decision logic explicitly, not just its inputs and outputs. It surfaces trust assumptions between agents and between agents and their tool providers. And it demands consideration of runtime states rather than just initial configuration.

In practice, threat modeling sessions structured around MAESTRO look substantively different from STRIDE exercises. Instead of walking a data flow diagram asking "where could an attacker spoof this?", teams walk an agent's potential decision tree asking "what could cause this agent to take an action its operator would not sanction, and what does that action touch?" The adversarial imagination required is categorically harder, because you're modeling a system that can surprise you in ways a static application simply cannot.

What Else Is Worth Using

Agent-Specific Attack Tree Extensions

Several security research groups have proposed extensions to classical attack tree methodology that account for agent autonomy and action chaining. The core innovation is treating the agent's own reasoning process as an attack surface: if an adversary can influence intermediate conclusions, they can influence terminal actions without ever touching code. These extensions are particularly useful for red-teaming exercises where the goal is mapping plausible manipulation chains rather than enumerating static vulnerabilities.

MITRE ATLAS

MITRE's ATLAS, the Adversarial Threat Landscape for Artificial-Intelligence Systems, provides an empirically grounded knowledge base of adversarial techniques targeting machine learning systems, following the ATT&CK matrix format. That makes it immediately legible to security teams already fluent in that vocabulary, which matters more than it should for organizational adoption. For agentic threat modeling, ATLAS is most productively used as a threat intelligence complement: it catches blind spots in MAESTRO-structured analysis and ensures coverage isn't purely speculative.

Much of ATLAS's documented technique corpus predates widespread autonomous agent deployment, however. It is growing in relevance as the field matures, but it should be treated as a complement to agentic-native frameworks, not a substitute.

Design Constraints as Threat Model Inputs

Some practitioners have begun treating minimal footprint and least-privilege design as threat modeling inputs rather than outputs. This is a subtle but meaningful inversion. If an agent cannot acquire credentials it doesn't need, it cannot misuse them. If it cannot take irreversible actions without a confirmation gate, the blast radius of any compromise is bounded before the compromise occurs. These aren't framework innovations; they're operationalized threat findings translated into design mandates before anything gets built.

How to Actually Apply This

Start with the agent's goal and authority, not its component diagram. Before mapping any system architecture, answer two questions: what is this agent authorized to do, and what is it trying to accomplish? The gap between those answers is where the interesting threat surface lives. An agent authorized to send emails that is trying to complete a research task will, under adversarial conditions, send a great many emails that nobody intended.

Model every data source the agent trusts. Every piece of external content an agent processes is a potential injection vector. Enumerate the sources, assess whether each is adversarially accessible, and trace what the agent would do if that content carried malicious instructions. This is the most routinely neglected step in agentic threat modeling and, predictably, where most actual incidents originate.

Apply MAESTRO layer by layer, then explicitly across layers. Cross-layer threats are structurally invisible to frameworks designed for monolithic systems, so they require a deliberate second pass. Without it, you'll produce a threat model that looks thorough and covers almost nothing that actually matters.

Incorporate ATLAS techniques as a checklist against your findings. It catches blind spots and provides shared vocabulary for communicating risk to stakeholders already fluent in the ATT&CK taxonomy, which saves time in rooms where that fluency is doing a lot of work.

Revisit the model at runtime. Every security team I've worked with will resist this because it has no comfortable analogue in their existing security programs. A threat model for an AI agent that is updated only at deployment is already stale. Establish a cadence for reviewing agent behavior logs against the threat model, and treat significant behavioral deviations as potential threat model invalidations, not just anomalies to be tuned away.

Where Things Actually Stand

The frameworks discussed here are real and meaningfully better than applying STRIDE to an autonomous agent and considering the job done. They are also young, and the adversarial research community is actively probing agentic systems in ways that will surface attack patterns none of these frameworks yet account for. The field is not mature. Anyone representing otherwise is selling something.

Security professionals who spent years mastering ATT&CK and STRIDE are not at a disadvantage — those analytical instincts transfer. What requires deliberate cultivation is architecture-awareness specific to agentic systems and the willingness to model cognition itself as an attack surface, an unfamiliar framing if your entire career has been oriented around network topology and access control. That reorientation takes time. Starting it now is materially better than waiting for the field to hand you a clean answer, because the field isn't going to.