Agentic Threat Model and Adversarial Defense
Threat model systems in which models interpret untrusted content and can take multi step action through tools.
A focused view of boundaries, contracts, state, authority, failure paths, and tradeoffs drawn from this chapter.
Reconstruct and defend this chapter’s architecture.
Reconstruct the architecture, name each boundary, and defend the tradeoffs.
Open the source exercise
Threat-model an agent reading an untrusted repository with shell, browser, issue, and pull-request tools. Add a malicious instruction, poisoned tool server, leaked token, and verifier deception. Mark preventive, detective, containment, and recovery controls.
4. Tradeoffs and alternatives
Strict isolation limits useful context and tool capability. Broad permissions increase success and blast radius. Risk-specific tool profiles and just-in-time elevation balance both. Recording full traces improves forensics and may expose sensitive data; redact, encrypt, restrict, and retain according to policy.
5. Current Mission Control Implementation
The current architecture includes policy, approvals, identity, scoped tools, sandboxes, network and secret boundaries, execution manifests, evidence, audit, supply-chain provenance, and prompt-injection discussion.
It does not yet present a complete agentic threat catalog, adversarial test corpus, memory-poisoning lifecycle, inter-agent trust model, denial-of-wallet controls, or exercised containment and forensic playbooks. This chapter establishes the security review baseline.
Review this chapter.
Challenge a claim, boundary, missing failure mode, unclear term, or unsupported evidence statement.
- Claim
- Boundary
- Failure
- Evidence