OWASP Agentic Threat Model and Red-Teaming Your Agent

By now this chapter has given you four separate defenses. You can break the lethal trifecta so injection cannot both read a secret and send it out. You can treat model output as untrusted before it touches a shell or a query. You can sandbox tools and scope each one to least privilege. You can give the agent a real, delegated identity instead of a shared superuser key.

Four defenses, and one question that ties them together: how do you know they hold, and how do you know you did not miss a threat none of them covers?

That is the job of this last lesson, and it has two halves. The first half is a map. The security research community, through OWASP, has already cataloged the ways LLM and agent systems get attacked. If you organize that catalog well, every defense you built lands on it in an obvious place, and any gap shows up as a branch with nothing defending it. The second half is a practice. A map tells you what could go wrong. Red-teaming tells you whether it actually does, by attacking your own agent on purpose and turning those attacks into a test that runs on every change.

Indirect prompt injection is not theoretical. Researchers have repeatedly shown production assistants reading a hidden instruction from a web page, a document, or an email and then leaking data or calling a tool the user never asked for. Simon Willison has written the clearest running account of this class of attack. The point of a threat model is to stop meeting these one surprise at a time and start meeting them as a list you already checked. By the end of the lesson you will have both halves in hand: a way to place any threat you ever read about, and a suite that tells you, on every commit, whether your specific agent is still safe.