Project · Active · started
Threat Modelling AI Systems: From LLM Features to Agents
A practical method for threat modelling anything built on a language model, from a single chat feature to agents that plan, call tools and keep memory. It combines STRIDE, CSA's MAESTRO layers and the OWASP Top 10 for Agentic Applications into one worksheet a product team can actually run.
Scope
Most teams shipping AI features either skip threat modelling or reuse a web-app template that misses the parts that matter: untrusted content steering the model, tools acting with the user’s authority, memory that outlives the session. This project builds a method that scales with autonomy: a lightweight pass for an LLM feature, and a deeper one once the system plans, calls tools or talks to other agents.
The method maps three existing bodies of work onto each other instead of inventing a new framework:
- STRIDE for the questions engineers already know how to ask.
- CSA MAESTRO’s seven layers to make sure nothing between the model and the ecosystem around it is left out.
- The OWASP Top 10 for Agentic Applications (ASI01–ASI10) as the checklist of risks that have already happened in the wild.
Status
Scoping. The first write-up covers a single LLM feature end to end; the agentic extension follows.
Planned artifacts
- Threat-model worksheet (STRIDE × MAESTRO layer × OWASP ASI risk)
- Worked example: a retrieval-augmented support assistant
- Worked example: a coding agent with repository and CI access