Enterprise AI threat model¶

• Draft
• v0.3.0
• Security architects and engineers
• Reviewed 2026-09-28

An AI threat model covers the same ground as any threat model: adversarial attack, accidental failure, misuse by authorized people, supplier compromise and unexpected behavior. AI adds two things. Natural language mixes instructions with data, so any text the model reads can try to steer it. Agents act on the model's output, so a steered model can take real actions.

This page names threats with public identifiers so teams can trace them to tests, controls and incidents:

Record the edition next to every ID. The 2026 LLM list reordered the 2025 list, so the same number now names a different risk.

OWASP scopes the LLM list to a model used as a component. When the model acts through tools, memory or other agents, use the Agentic list alongside it.

Assets¶

Trust boundaries¶

Draw each boundary on the system diagram and record what crosses it.

Threat catalog¶

AI-specific threats in more depth¶

Improper output handling¶

Model output is untrusted input to whatever consumes it. OWASP defines the weakness as "insufficient validation, sanitization, and handling of the outputs generated by large language models before they are passed downstream". Generated text reaches browsers, shells, SQL engines, template renderers and other agents. Encode output for its destination, use parameterized queries, run generated code in a sandbox with no standing credentials, and never pass output to eval or a shell.

Excessive agency and multi-agent risk¶

An agent can do as much damage as its tools allow, whatever its instructions say. Give each agent the fewest tools, the narrowest scopes and the shortest-lived credentials its task needs. Require human approval for actions that are consequential, hard to reverse or outside a transaction limit. In multi-agent systems, authenticate every agent, validate every message against a schema, and stop one agent's failure from cascading with timeouts and circuit breakers.

OWASP's 2026 prompt injection entry recommends the "Rule of Two" as a minimum check on agent capabilities. Look for three capabilities in each agent:

An agent with all three needs human approval for every action. An agent with two of them needs a documented residual-risk assessment.

MCP servers and tool poisoning¶

The Model Context Protocol (MCP) connects agents to tools. The model reads tool descriptions, so a malicious or compromised server can hide instructions in them. Invariant Labs described these tool poisoning attacks in April 2025. The same report named two variants.

Pin tool definitions and alert on changes, show users the full description, run each server in isolation, and allowlist the servers an agent may use. The zero-trust AI page covers MCP authorization controls.

Hidden context exposure¶

Assume users can extract anything in the model's context: the system prompt, developer instructions, retrieved policy text and tool schemas. OWASP's 2026 entry defines the risk as "the unauthorized extraction, inference, or reconstruction of hidden, non-user-facing system instructions or operational context placed in a model's context". The fix is architectural: keep credentials, internal hostnames and authorization rules out of prompts, and enforce access control in code outside the model.

Required outputs¶

Record these for every AI system, and review them at each lifecycle gate:

• system and trust-boundary diagrams
• assumptions and out-of-scope threats
• threats with their catalog IDs and editions
• affected assets
• controls and their validation evidence
• residual risks, with owners and acceptance decisions
• reassessment triggers

Link each threat to a detection in production and to an incident response playbook.

Sources¶

Checked 2026-09-28.

• OWASP Top 10 for LLM Applications 2026
• OWASP Top 10 for LLM Applications 2025 (for the crosswalk)
• OWASP Top 10 for Agentic Applications for 2026
• MITRE ATLAS data v2026.09
• NIST AI 100-2e2025
• Invariant Labs, MCP tool poisoning attacks (2025-04-01)