Research seriesL2offensive security
Classic threat modeling assumes a separable data/control plane and static, checkable trust boundaries. Agentic AI violates both — so a STRIDE-clean threat model can be walked straight through. A red-team analysis of exactly which assumptions break, why, and what replaces per-element enumeration.
A threat model can pass every letter of STRIDE and still be walked straight through. The reason is structural: agents violate the assumptions the method is built on.
If per-element enumeration can't hold the threat, change the unit. Model the agent by the authority it can reach and the trust of the words that steer it.
When an agent acts, three identities are in the room at once. Threat modeling that tracks only one of them misses the delegation chain where agentic authority is actually abused.
One agent has a hard-enough trust boundary. Connect several agents and a fleet of tools, and the dangerous surface is no longer any single element — it is the edges between them.