Limitations of STRIDE in Threat Modeling AI Agents

Summary

The STRIDE threat modeling framework, widely used for securing traditional software systems, is inadequate for AI agents due to their non-deterministic and autonomous nature. AI agents fuse code and data into a single stream of tokens, breaking STRIDE’s core boundary assumption.

Technical Overview

Agentic AI systems, such as those using Large Language Models (LLMs), process untrusted input and execute logic simultaneously, making it challenging to apply traditional threat modeling frameworks like STRIDE. The EchoLeak attack on Microsoft 365 Copilot demonstrates the limitations of STRIDE in identifying threats in AI systems.

Key Impact & Implications

The inability of STRIDE to model threats in AI agents has significant implications for the security of systems that rely on these technologies. As AI becomes increasingly prevalent in various industries, the need for effective threat modeling and mitigation strategies becomes more pressing.

Action & Mitigation

To address the limitations of STRIDE, a new approach is necessary. This includes mapping architecture to threat zones, tracing attack scenarios as chains, validating against agentic factors, and formalizing high-risk chains as attack trees. The OWASP Agentic Top 10 provides a useful framework for identifying and mitigating threats in AI systems. By adopting this new approach, organizations can better protect their AI-powered systems from potential threats and improve overall security posture.