Back in ’99, an engineer named Loren Kohnfelder wrote up “The Threats To Our Products” and gave security teams an acronymโSTRIDEโwe’ve leaned on ever since.
Almost thirty years later, AI agents are reading inboxes, running code, and calling APIs on our behalf. And STRIDE fits them almost uncomfortably well.
I don’t think that’s luck. Kohnfelder was pointing at something underneath the tech!
How trust moves between systems. Agents might be the messiest trust problem we’ve ever shipped.
๐๐ฒ๐ฟ๐ฒ’๐ ๐๐ต๐ฒ ๐ณ๐ฟ๐ฎ๐บ๐ฒ๐๐ผ๐ฟ๐ธ, ๐ฎ๐ฝ๐ฝ๐น๐ถ๐ฒ๐ฑ ๐๐ผ ๐ฎ๐ด๐ฒ๐ป๐๐:
๐ฆ โ ๐ฆ๐ฝ๐ผ๐ผ๐ณ๐ถ๐ป๐ด. Prompt injection. An attacker hides instructions in a doc or email the agent reads, dressed up to look like they came from you. The agent obeys, because it can’t always tell your instructions from theirs. (OWASP ranks this #1 for LLM apps.)
๐ง โ ๐ง๐ฎ๐บ๐ฝ๐ฒ๐ฟ๐ถ๐ป๐ด. Poisoned dataโeither in training or in a compromised API the agent trusts. Goes in upstream, shows up downstream in production.
๐ฅ โ ๐ฅ๐ฒ๐ฝ๐๐ฑ๐ถ๐ฎ๐๐ถ๐ผ๐ป. An agent fires off a purchase or edits a file autonomously, and the audit trail is patchy or missing. Something breaks and nobody can prove what happened. Accountability quietly evaporates.
๐ โ ๐๐ป๐ณ๐ผ๐ฟ๐บ๐ฎ๐๐ถ๐ผ๐ป ๐๐ถ๐๐ฐ๐น๐ผ๐๐๐ฟ๐ฒ. Models can cough up training data when prompted right. And a long-running agent piling up context can be nudged into leaking it.
๐ โ ๐๐ฒ๐ป๐ถ๐ฎ๐น ๐ผ๐ณ ๐ฆ๐ฒ๐ฟ๐๐ถ๐ฐ๐ฒ. Inference costs real money. Force an agent into a loop and you get both downtime and an ugly cloud bill. MITRE ATLAS calls it “Cost Harvesting.”
๐ โ ๐๐น๐ฒ๐๐ฎ๐๐ถ๐ผ๐ป ๐ผ๐ณ ๐ฃ๐ฟ๐ถ๐๐ถ๐น๐ฒ๐ด๐ฒ. Agents get broad permissions to stay useful. A prompt injection can ride those permissions and do anything the deploying user could. Most agents in production are wildly over-privileged.
The threats aren’t a new shape. They’re just harder to spot, because agents behave probabilistically. You can’t read the source and point at the bugโyou have to poke the thing and see what falls out.
That’s exactly why the old frameworks earn their keep: they hand you the right questions even when the system’s a black box.
