Tools
Threat Modeler Guide
How to model an agentic system, what the analysis engine checks and how to read its results. The reference tables are generated from the modeler's own palette, rule catalog, templates and shortcuts, so they always match the tool.
- 49 rules
- 13 component types
- 10 templates
How to model a system
- Start from a template or an empty canvas.
- Drag components from the palette: agents, models, memory, tools, data stores and external services.
- Connect them with data flows and group them into trust boundaries.
- Set each component's properties (trust level, authentication, data sensitivity).
- Run Analyze to get threats, attack paths, AISVS coverage and the mitigations to apply.
- Save, share or export the model.
Component types
- Agent: Plans and acts on untrusted input; the main target of goal hijacking.
- Orchestrator: Delegates to other agents; a compromise cascades to every worker.
- LLM: Follows instructions found anywhere in its context window.
- Episodic Memory: Persists what the agent saw; poisoned entries steer future sessions.
- Semantic Memory: Long-lived facts the agent trusts; a write path for persistent injection.
- Vector Store: Retrieved chunks enter the prompt verbatim (RAG poisoning).
- Tool (scoped): Every tool call is an action; scopes and allow-lists bound the blast radius.
- MCP Server: Tool descriptions and results flow straight into the model (tool poisoning).
- A2A Peer: Another organisation's agent: its messages are untrusted instructions.
- Guardrail / Policy: Inspects traffic it sits on; lowers likelihood of threats behind it.
- Human Approval Gate: Breaks attack paths to privileged actions — if approvals stay meaningful.
- Identity Provider / Credential: Issues the tokens agents act with; delegation without narrowing is privilege abuse.
- Observability: Without traces you cannot detect a rogue or hijacked agent.
MAESTRO layers
Every finding is placed on a layer of the CSA MAESTRO threat-modeling framework for agentic AI.
- Foundation Models
- Data Operations
- Agent Frameworks
- Deployment & Infrastructure
- Evaluation & Observability
- Security & Compliance
- Agent Ecosystem
Analysis rules
| Rule | What it detects | Maps to |
|---|---|---|
| TM-AGT-001 Unverified MCP server provenance | An MCP server that is not signed and version-pinned can be swapped or updated to a malicious build (rug pull) that every connected agent trusts. | ASI04 T17 C10, C6 |
| TM-AGT-002 MCP tool poisoning and over-exposed tools | Tool descriptions and results from an MCP server are model-visible content: a malicious description can instruct the agent, and a broad tool set widens what a hijacked agent can do. | ASI02 T16 C10 |
| TM-AGT-003 Unauthenticated remote MCP transport | A network-reachable MCP server accepts calls without authentication, so anyone who can reach it can invoke its tools or impersonate the client. | ASI03 T16 C10, C5 |
| TM-AGT-010 Write-scoped tool without allow-list or rate limit | A tool granted write/admin scopes has no allow-list of permitted operations or no rate limit, so misuse is unbounded. | ASI02 T2 C9, C5 |
| TM-AGT-020 A2A peer without mutual authentication | A remote agent peer is not mutually authenticated, so an attacker can impersonate it and send instructions or receive delegated tasks. | ASI07 T9 C9 |
| TM-AGT-021 A2A messages not signed or schema-validated | Authenticated peers still exchange unsigned, free-form messages; a compromised peer or relay can alter tasks and smuggle instructions. | ASI07 T12 C9 |
| TM-AGT-030 Shared memory writable by untrusted agents | Untrusted agents or sources have write access to memory that other agents trust — the highest-impact form of memory poisoning. | ASI06 T1 C8 |
| TM-AGT-031 Memory without per-user isolation | Memory shared across users without isolation lets one user's data surface in another user's session, or one user poison everyone's context. | ASI06 T1 C8, C5 |
| TM-AGT-032 Indefinite retention of sensitive memory | Sensitive conversation data is retained indefinitely, increasing breach impact and conflicting with data-minimisation duties. | C8 |
| TM-AGT-040 Overwhelming human-in-the-loop (approval fatigue) | One approval gate fronts many high-risk actions; reviewers rubber-stamp under volume and attackers can hide a harmful request in the queue. | ASI09 T10 C9 |
| TM-CONN-001 Direct prompt injection / agent goal hijack | Untrusted input flows straight into an AI component that treats it as instructions, letting an attacker override goals, extract data or trigger tools. | ASI01 T6 C2 |
| TM-CONN-002 Indirect prompt injection via tool or API output | An AI component consumes output from an untrusted tool, web page or external API; instructions hidden in that content are executed as if they came from the user. | ASI01 T6 C2, C9 |
| TM-CONN-003 Tool misuse via a hijacked agent | A manipulated agent invokes a tool with legitimate permissions in a harmful way; severity follows the tool's access mode and risk tier. | ASI02 T2 C9 |
| TM-CONN-006 Insecure inter-agent communication | Messages between agents lack mutual authentication, integrity or schema validation, so a compromised or spoofed peer can inject instructions into another agent. | ASI07 T12 C9 |
| TM-CONN-007 Insecure connection to an external system | A flow to or from an external system is unencrypted or unauthenticated, allowing eavesdropping, tampering or spoofed data. | C4, C5 |
| TM-CONN-008 Unencrypted internal data flow | Internal traffic in clear text can be read or modified by anyone on the path. | C4 |
| TM-CONN-009 Sensitive data sent to an untrusted component | PII or confidential data flows to an external or untrusted component without evidence of minimisation or redaction. | C7 |
| TM-CONN-010 Unauthenticated access from an entry point | A user-facing entry into the system has no authentication, so anyone can impersonate users, abuse the agent or exhaust it. | ASI03 T9 C5 |
| TM-CONN-011 Cross-boundary flow without authentication | A flow crosses a trust boundary without authentication, so a compromised component in one zone can talk to another zone as anyone. | C5, C4 |
| TM-CONN-012 Data-layer compromise crosses into the agent zone | A store in a less-trusted zone feeds an agent in a more-trusted zone; poisoned data crosses the boundary and misaligns the agent's goals (MAESTRO L2 → L7). | ASI06 T1 C8, C9 |
| TM-CONN-013 Lateral movement from execution environment to data | An execution environment has a direct path to a data store; code run there (by a hijacked agent) can read or alter the data (MAESTRO L4 → L2). | T3 C4 |
| TM-MODEL-001 Components outside any trust boundary | Trust zones are defined but some components sit outside all of them, so their trust assumptions are implicit. | C4 |
| TM-MODEL-002 Agent and tool activity is not observable | No observability component covers these agents or high-risk tools, so hijacks, loops and cascading failures go undetected and cannot be reconstructed. | ASI08 T8 C12 |
| TM-MODEL-003 Unverified agent framework and tool supply chain | Agent frameworks, tool packages and containers are used without declared signed provenance or pinned versions. | ASI04 T17 C6 |
| TM-MODEL-004 Cascading failure through a shared store | Three or more agents read and write the same store with no gate in between; one poisoned or hallucinated entry propagates to every agent. | ASI08 T5 C8, C9 |
| TM-MODEL-005 Rogue agent containment gap | Several collaborating agents with no behavioural monitoring covering all of them: a compromised or drifting agent can act unnoticed and cannot be isolated. | ASI10 T13 C9, C12 |
| TM-MODEL-006 Empty trust boundary | A trust boundary contains no components, which usually means the model is incomplete. | C4 |
| TM-MODEL-007 Excessive trust-boundary crossings | A component exchanges data with three or more trust zones, which widens its attack surface and blurs zone separation. | C4 |
| TM-NODE-001 Model safety-alignment bypass (jailbreak) | Adversarial prompts crafted to bypass the model's safety training and system instructions so it produces disallowed output or follows attacker goals. | ASI01 T6 C11, C7 |
| TM-NODE-002 Model extraction through an exposed endpoint | An externally reachable model can be systematically queried to replicate its behaviour or recover proprietary fine-tuning. | C11 |
| TM-NODE-003 Unverified model provenance (backdoored weights) | Model weights obtained without signed provenance or a pinned version may contain backdoors or poisoned behaviour that activates on attacker triggers and flows into every caller. | ASI04 T17 C6, C3 |
| TM-NODE-004 Training / fine-tuning data poisoning | Poisoned samples in the fine-tuning or training pipeline implant behaviour the attacker can trigger later. | C1 |
| TM-NODE-005 Membership inference / training-data disclosure | Queries against a fine-tuned model reveal whether specific records were in its training data or regurgitate them. | C11 |
| TM-NODE-006 Resource exhaustion / denial of wallet | Unbounded, expensive or recursive requests from an entry point exhaust model capacity or budget. | T4 C4 |
| TM-NODE-010 Memory & context poisoning | Content an attacker can influence is written to persistent memory and later retrieved as trusted context, steering future sessions or other agents. | ASI06 T1 C8 |
| TM-NODE-011 Retrieval source poisoning (indirect prompt injection) | A retrieval store ingests content from an untrusted source; documents carrying hidden instructions are retrieved into model context and hijack its behaviour. | ASI01, ASI06 T1 C8, C2 |
| TM-NODE-012 Sensitive data disclosure from a store | A store holding PII, credentials or regulated data is queryable through an AI component that an attacker can steer, enabling exfiltration through responses. | C8, C7 |
| TM-NODE-020 Function-call schema exploitation | Crafted input manipulates a function-calling schema to invoke unintended functions or pass malicious arguments. | ASI02 T2 C9 |
| TM-NODE-021 System prompt extraction | Attackers coax the model into revealing its system prompt, exposing business logic, guardrail wording or embedded secrets. | C7, C2 |
| TM-NODE-022 Excessive agency | One agent holds many or high-risk tools, so a single hijack or reasoning error has a large blast radius. | ASI02 T2 C9, C5 |
| TM-NODE-023 Lethal trifecta: untrusted content, private data and an exfiltration channel | One agent is exposed to attacker-controlled content, can read private data and can send data out. An indirect prompt injection can exfiltrate that data without any user action. | ASI01 T6 C9, C7 |
| TM-NODE-030 Unexpected code execution | A component executes model-generated code or commands; a hijacked agent can run arbitrary code on the host and pivot from it. | ASI05 T11 C9, C4 |
| TM-NODE-040 Sensitive data leakage through telemetry | Prompts, responses and tool arguments captured in logs or traces expose PII and secrets to anyone with dashboard access. | C12 |
| TM-NODE-041 Audit trail tampering (repudiation) | Agents that can write to their own audit trail can erase or forge evidence of what they did once compromised. | T8 C12 |
| TM-NODE-050 Guardrail evasion | Obfuscated, encoded or multi-turn inputs slip past the guardrail; traffic it does not inspect is not protected at all. | ASI01 C2, C7, C11 |
| TM-NODE-060 Single point of failure | A hub connected to nearly every component: its compromise or outage affects the whole system. | ASI08 C4 |
| TM-PATH-001 Privileged action reachable without human approval | Untrusted input can drive a destructive, executing or critical tool without passing a human approval gate. | ASI02 T2 C9 |
| TM-PATH-002 Delegated user credential reaches a tool without scope narrowing | The agent acts on the user's behalf with their full credential; a hijacked agent can use it for anything the user could do (confused deputy). | ASI03 T3 C5, C9 |
| TM-PATH-003 Cascading compromise across an agent chain | Untrusted influence passes through three or more agents with no gate or validation; one agent's error or hijack cascades through the chain. | ASI08 T5 C9 |
Templates
- RAG Pipeline: Retrieval-Augmented Generation pipeline with user, LLM, vector store, and external data source.
- Hierarchical Multi-Agent: Orchestrator delegating to a research agent (web search) and a coding agent (code execution).
- Simple Agent: A single agent with memory and an LLM.
- Sequential Pipeline: Input validation, processing agent and an output guard in a fixed sequence.
- Collaborative Swarm: Peer agents collaborating over mTLS and sharing a knowledge base.
- Reactive Agent: Event-driven agent that decides with an LLM, acts through a tool and logs events.
- Knowledge-Intensive Agent: Agent combining vector search, a knowledge graph and external APIs.
- MCP-connected Coding Agent: IDE coding agent using a local filesystem MCP server, a remote GitHub MCP server behind an approval prompt, a community MCP server and a code sandbox.
- Customer-Support Agent (RAG + HITL): Support agent behind an input/output guardrail, answering from a knowledge base, with per-user memory, an audit log and human approval for refunds.
- Multi-Agent Research Swarm (A2A): Coordinator delegating over A2A to internal research and analysis agents and to a partner organisation's agent, with shared memory and tracing.
Keyboard shortcuts
| Keys | Action |
|---|---|
| Ctrl/⌘+S | Save the current model |
| Ctrl/⌘+Z | Undo |
| Ctrl/⌘+Shift+Z or Ctrl/⌘+Y | Redo |
| Ctrl/⌘+Enter | Run threat analysis |
| ? | Show keyboard shortcuts |
| Delete or Backspace | Delete the selected components / flows |
| Ctrl/⌘+A | Select every component |
| Ctrl/⌘+C | Copy selection (with the flows between it) |
| Ctrl/⌘+V | Paste |
| Ctrl/⌘+D | Duplicate selection |
| ←+↑+→+↓ | Move selection by 8 px |
| Shift+Arrow | Move selection by 32 px |
| C | Start a data flow from the selected component (then focus a target and press Enter) |
| Enter | Finish the connection on the focused component |
| Esc | Cancel connection / clear selection |
| F or Ctrl/⌘+0 | Fit the model to the view |
| + | Zoom in |
| - | Zoom out |
| G | Wrap the selection in a trust boundary |
| T | Tidy layout (animated) |