Disclaimer
This article is intended for informational purposes and reflects the state of published research and industry practice as of its publication date. It is not professional security advice. Your specific environment, threat model, and regulatory obligations will shape how these principles apply to your situation. The views and opinions expressed here are my own and do not represent the position of my employer, SAP, or any other affiliated organization.
For Security Leaders
The security review methods most organizations rely on were built for software that behaves the same way every time. AI agents do not, so a competent review can still miss what matters, because the risk is assembled while the system runs. You can pass a full threat review and still miss the failure that reaches your payment data.
What this means for your organization:
A clean threat model is not evidence of a safe system. Both methods assume the design can be mapped before the software runs.
The riskiest capabilities are the ones the business asked for. There is nothing to switch off without stopping the work.
The losses will not look like breaches. A wrongly approved supplier produces a payment, not an alert.
What to tell your teams:
Ask which tool descriptions and agent instructions can change at runtime, and who can change them without a code review.
Draw two arrows where you drew one: what a tool may do, and what it currently claims it does.
Stop treating a data-flow diagram as the finished model for anything with an agent in it.
Trace every finding to a business consequence, and monitor approval and payment paths, not only data theft.
In this piece we’ll look at threat modeling, and for that I chose FinBot, the deliberately vulnerable capture the flag platform built by the OWASP GenAI Security Project’s Agentic Security Initiative and described by its authors as the Juice Shop for agentic AI, as the sandbox to be evaluated. That gives me the freedom to break it and to validate the assumptions that will be presented throughout this article.
To decide which tool to call, an agent reasons over the tool’s description, an attribute explaining what the tool does and what its parameters mean. In FinBot, those descriptions are rewritable. Everything I describe about the platform is as I found it at commit 1450fc4d, June 2026, since it is under active development and any of it may have moved since. The MCP (Model Context Protocol) server factory reads override rows from the application database every single time an agent runs, builds a fresh instance of the tool server from them and finally hands it over to the agent even before the first prompt is assembled. A row written between two agent runs is live on the second one.
Someone decided that rewriting what a tool claims to do was worth building, and that is the sort of finding we want to extract from a threat modeling session. If your own diagram has a single arrow from agent to tool, you have collapsed two questions into one: what the tool is authorized to do, and what the tool currently claims it does. You will only find out which one failed after something goes wrong.
Why would somebody even think about doing that? In FinBot the answer is that the vulnerability is the point. The platform ships a portal describing an adversary-perspective threat surface for supply chain attacks, and wires a detector to score you when the overrides you planted produce an exfiltration. In a production system the same mechanism arrives as a business requirement, which is why it belongs in a threat model rather than a curiosity list.
What I intend with this article is to draw the map before we test any of it (which we’ll do in following articles on FinBot). We will assess assets, actors, trust boundaries, agent goals, tools, and business outcomes, built against a technical architecture diagram. Building this map is worth more than any of the exploits, because the exploit without the map is an anecdote. The problem is that the two methods I still see reached for most often were built for systems that hold still, and the override is exactly the kind of thing they were not built to see.
What a conventional threat model assumes
Both STRIDE and PASTA assume you can fully map the system before you run it. They are two of the most widely used methodologies in practice, the choice between them running along a threat-centric versus risk-centric axis rather than a shallow versus deep one. Neither is perfect, and when it comes to agentic applications that shared assumption goes away, though not at the same cost to each.
That last claim is not new, and I’m not the first to arrive at it. Ken Huang’s MAESTRO announcement at the Cloud Security Alliance in February 2025 opens by walking through STRIDE, PASTA, DREAD, OCTAVE and LINDDUN and finding each of them short against autonomous systems. Bishop Fox published a direct comparison in April 2026 arguing that STRIDE breaks because an AI agent behaves as a process, a data store, a dataflow and an actor at once, trusted in one interaction and hostile in the next. Zambare and colleagues make the same point about PASTA in a 2025 threat modeling paper. Its system boundaries are relatively fixed, and it assumes attacker goals are pre-determined and data flows are fixed.
Even though there’s agreement that they fail, there’s no universal agreement on why. That matters, because a wrong diagnosis produces the wrong replacement. The usual version is that these methods are static and agentic systems are dynamic. That framing invites the obvious rebuttal, which is to model more often, and modeling more often does not help. The failure is structural, and it is worth being exact about where it sits.
In 1999, two Microsoft engineers, Loren Kohnfelder and Praerit Garg, wrote an internal memo that gave their employer, and eventually the industry, a way to talk about threats: STRIDE, an acronym for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Microsoft’s SDL later tied the taxonomy to data-flow diagrams, and from that pairing came the per-element and per-interaction analysis methods still widely used. The framework has lasted because it is memorable, cheap to adopt, and legible to developers and auditors alike.
Every STRIDE category is the negation of one named security property. Spoofing negates authenticity, tampering negates integrity, repudiation negates accountability, and so on down the list. The taxonomy is therefore complete, but only with respect to that property set, and completeness is relative to the input. So, the way I look for a gap is not to hunt for an attack STRIDE misses; it is to ask whether the system has a property worth protecting that is absent from the list the acronym was built from.
Agentic systems have several. Whether the agent stays faithful to the principal’s intent. Whether its autonomy is bounded. Whether its actions remain controllable or reversible. None of these had a name in 1999, because a 1999 system had no intent of its own to diverge from yours.
Prompt injection makes the gap concrete. In the ordinary case nothing is modified at all, since the attacker only has to author content in a channel the agent was built to read. Where something is modified, say a page poisoned today and pulled into a retrieval index next week, tampering names the edit and stops there. It says nothing about what the edit achieves, and what it achieves is control over what the agent does next. Elevation of privilege is no better a fit, because the agent exercises authority it already holds toward an objective its principal never set.
FinBot’s rewritable tool descriptions are that shape exactly. An authorized write to an authorized table changes what the agent believes a tool is for, and no property in the taxonomy has been violated by the time the agent acts on it. STRIDE’s integrity reasoning presumes that instruction and data occupy separate channels, and a language model collapses that separation by design.
The diagramming layer runs into a different problem. Data-flow analysis is organized around trust boundary crossings, but an agent assembles system prompt, user input, retrieved documents, tool output, and stored memory into one context that sits at one effective trust level. The boundaries drawn on the whiteboard are therefore not the boundaries the runtime actually enforces. Design time can still enumerate the elements, but an agent decides at runtime how those elements compose and in what order, driven by task content, and the path that matters to an attacker is seldom the path that was diagrammed.
A last mismatch has nothing to do with diagrams, as many agentic failure involves no adversary whatsoever, and a taxonomy framed around attackers returns nothing for goal drift, for preconditions the model invented, or for autonomy that never finds its stop condition.
My conclusion is not that STRIDE should be discarded. As a tool for asking what could be attacked, it still works. What it can no longer do is enumerate how those attacks compose, because the composition is generated after the diagram is drawn, and it was never built for failures that are not attacks at all.
Tony UcedaVélez and Marco Morana created PASTA, the Process for Attack Simulation and Threat Analysis, and set the method down in full in their 2015 book. It is a risk-centric method aimed at higher-stakes engagements, and what sets it apart is a single commitment. Every technical threat has to be traceable to a business consequence. The method runs through seven stages: define objectives, define technical scope, decompose the application, analyze threats, analyze vulnerabilities and weaknesses, model attacks, and analyze risk and impact.
The stages are deliberately ordered, and each one feeds on the output of the one before it. That sequencing gives PASTA its rigor and also creates its weak points. Stage three, application decomposition, produces the inventory of actors, assets, entry points, and trust boundaries, along with the data-flow diagrams everything downstream relies on. The inventory survives the shift to agentic systems. FinBot’s agents, tool servers, data stores, and integrations are all countable at design time. The diagrams do not survive it, for the reason already given, and FinBot shows it at the level of a single edge. The tool inventory is stable between runs, but what each tool claims to do is not, because the MCP factory rebuilds it from the database every time.
The breakage downstream is not uniform. Threat analysis and weakness correlation largely survive, since the intelligence corpus and the component inventory both still exist. Stage six is where the method breaks. Attack modeling constructs attack trees, and an attack tree can only enumerate paths through a structure that exists before the analysis starts. In an agentic application, the planner generates that structure after the fact, and an attacker who can shape content can shape the planner. Stage seven inherits the problem, since pricing likelihood and impact depends on the attack paths that stage six failed to deliver.
The framing is what endures. Setting objectives, bounding the technical scope, and reasoning from business consequence are still the right moves, and PASTA’s rule that every finding connect to a business outcome matters more for agentic systems than for the traditional ones, because agents act on the world instead of just storing records about it. Underneath everything we find a cadence problem. Seven sequential stages presume a system that holds still long enough for the analysis to finish, and an agentic application changes shape whenever a model version updates, a tool is added, or a prompt is edited. PASTA asks the right questions. It can no longer produce the answers on its own.
To continue reading this article, please subscribe, the entire article is available for free for all subscribers (free or paid).
Peace. Stay curious! End of transmission.
Fact-check appendix
Statement: FinBot is described by the OWASP GenAI Security Project as the “Juice Shop for Agentic AI,” an intentionally vulnerable multi-agent application built by its Agentic Security Initiative. | Source: OWASP GenAI Security Project, “FinBot Agentic AI Capture The Flag (CTF) Application”, https://genai.owasp.org/resource/finbot-agentic-ai-capture-the-flag-ctf-application/
Statement: STRIDE breaks down for agentic AI because an AI agent can act as multiple entities at once, being a process and also a data store, a dataflow and an actor, and can be a trusted internal actor for one process while a potentially malicious external actor for another. | Source: Shad Malloy, “Taking Maestro in Stride”, Bishop Fox, 16 April 2026, https://bishopfox.com/blog/taking-maestro-in-stride
Statement: PASTA’s system boundaries are relatively fixed, and it assumes attacker goals are pre-determined and data flows are fixed, which limits its application to agentic systems that learn and adapt at runtime. | Source: Zambare, P., Thanikella, V. N., and Liu, Y., “Securing Agentic AI: Threat Modeling and Risk Analysis for Network Monitoring Agentic AI System”, arXiv:2508.10043 (2025), https://arxiv.org/abs/2508.10043
Statement: FinBot’s Model Context Protocol factory reads tool-description override rows from the application database on every agent run, builds a fresh tool server from them, and hands it to the agent before the first prompt is assembled. | Source: Architecture read at commit 1450fc4d15cbe80dbaf52dde1df767dbc967e32e, finbot/mcp/factory.py and finbot/agents/base.py; registration confirmed on a local run, 2026-07-25.
Statement: FinBot’s vendors table stores bank and tax identification numbers in the same record as the trust_level and risk_level fields that gate authorization. | Source: Architecture read at commit 1450fc4d15cbe80dbaf52dde1df767dbc967e32e, database schema; confirmed against the running instance, 2026-07-25.
Statement: The lethal trifecta is access to private data, exposure to untrusted content, and the ability to communicate externally. | Source: Simon Willison, “The lethal trifecta for AI agents”, 16 June 2025, https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
Statement: STRIDE is a six-category mnemonic applied against data-flow diagrams, originating with Kohnfelder and Garg in the late 1990s. | Source: Microsoft Security Development Lifecycle threat modeling documentation, https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling and https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats
Statement: PASTA is a seven-stage, risk-centric method tying technical threats to business impact, published by UcedaVelez and Morana in 2015. | Source: UcedaVelez and Morana, “Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis”, Wiley 2015, https://dl.acm.org/doi/10.5555/2834500
Statement: OWASP’s Top 10 for Agentic Applications defines ASI01 through ASI10, including goal manipulation, tool misuse and memory poisoning as categories in their own right. | Source: OWASP GenAI Security Project, https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
Statement: CSA MAESTRO decomposes an agentic system into seven architectural layers. | Source: Cloud Security Alliance, https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro
Statement: CVE-2025-32711 is an AI command injection in Microsoft 365 Copilot allowing an unauthorized attacker to disclose information over a network. Microsoft published it on 11 June 2025, scored it CVSS 3.1 base 9.3, recorded User Interaction as None in the vector, and marked Remediation Level as Official Fix. | Source: MITRE CVE record, https://www.cve.org/CVERecord?id=CVE-2025-32711 ; vendor advisory, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711
Statement: Aim Labs discovered the vulnerability, named it EchoLeak, and state that an adversary need only send an email to the victim, with no restriction on the sender and no specific victim behavior required. | Source: Aim Labs, “EchoLeak” research disclosure, https://aim.security/lp/aim-labs-echoleak-blogpost
Statement: The architecture diagram reproduced in this article is FinBot’s own, copied without modification from the project’s docs/architecture.md. The TODO and partial labels on it are the project’s, not mine. | Source: OWASP-ASI/finbot-ctf, docs/architecture.md at commit 1450fc4d15cbe80dbaf52dde1df767dbc967e32e (committed 9 June 2026), https://github.com/OWASP-ASI/finbot-ctf/blob/1450fc4d15cbe80dbaf52dde1df767dbc967e32e/docs/architecture.md ; retrieved and verified byte-identical 2026-09-08. The branch-tracking copy at https://raw.githubusercontent.com/GenAI-Security-Project/finbot-ctf/refs/heads/main/docs/architecture.md follows main and may drift from what is shown here. Reproduced under the repository’s Apache License 2.0, copyright 2025 OWASP Foundation and contributors.
Statement: FinBot exposes tool-description overrides through a player-facing portal self-described as an adversary-perspective threat surface for supply chain attacks, and a detector scores challenges on populated override configuration. | Source: Architecture read at commit 1450fc4d, finbot/apps/darklab and finbot/ctf/detectors/implementations/indirect_exfil.py, OWASP-ASI/finbot-ctf at commit 1450fc4d15cbe80dbaf52dde1df767dbc967e32e, captured 2026-07-25.
Top 5 sources
OWASP Top 10 for Agentic Applications 2026, OWASP GenAI Security Project, Agentic Security Initiative (December 2025). Authoritative because it is the framework’s own text with a stated review process involving more than 100 named contributors, and it cites dated incidents rather than hypothetical scenarios.
Cloud Security Alliance, “Agentic AI Threat Modeling Framework: MAESTRO” (February 2025). Authoritative because it is the first threat-modeling framework built specifically for agentic architectures by a named industry standards body, and it supplies the layered decomposition this article’s argument turns on.
Simon Willison, “The lethal trifecta for AI agents” (16 June 2025). Authoritative as the primary statement of a framing this article leans on, from a named independent researcher whose work on prompt injection is widely cited. Used for its analytical frame; the FinBot-specific application rests on the architecture read.
Aim Labs, “EchoLeak” disclosure, with MITRE CVE record CVE-2025-32711. Authoritative as the original research alongside the vendor-assigned CVE, which supplies the severity, the no-user-interaction vector and the fix status independently of the researchers’ account.
UcedaVelez and Morana, “Risk Centric Threat Modeling” (Wiley, 2015). Authoritative as the primary text for PASTA, by the method’s own authors, for the seven stages and the business-consequence rule this article keeps.
P.S. How AI was used in the creation of this piece:
The idea is mine.
AI helps me brainstorm the argument’s spine and structure.
AI helps me with research, which I verify before anything goes into the article.
I write the full draft myself, over the course of several days.
I pass the draft through AI for an editing pass, using prompts I designed myself.