AckuityRequest assessment THREAT MODELS / AI AGENT SECURITY
Agent risk lives in tools, memory, permissions and hand-offs. Ackuity checks every action against 60+ threat models in 14 categories, mapped to NIST, OWASP and MITRE ATLAS.
Prepare the vendor renewal summary.
Read contracts · Compare renewal datesAssume finance-admin.
Outside task scope → Constrain14 THREAT CATEGORIES
Each category lists example threat models. Ackuity weighs every action against the security context graph for AI agents built for it.
One agent tricks, impersonates or colludes with another, and bad instructions spread from agent to agent.
An attacker plants false information in what the agent remembers or retrieves, so its later actions go wrong.
The agent chases something other than its assigned goal, or only pretends to follow its rules.
The agent uses more access than the task needs, or gets tricked into using its access on someone else's behalf.
The agent writes or runs code, queries or API calls that carry an attack.
A user or an agent passes itself off as someone it is not.
The agent manipulates the people it works with, or hides what it is doing from them.
The agent burns through compute, API quotas or time, by accident or by design.
The agent sends personal, health, confidential or proprietary data somewhere it should not go.
The agent runs a risky command, uses a poisoned or compromised tool, or chains safe tools into an unsafe result.
Injected instructions pull the agent away from the task the user actually asked for.
The agent floods or misleads the people meant to review it, so bad actions get approved.
A Model Context Protocol server or its configuration is hijacked, poisoned or set up insecurely.
The agent breaks a data access or handling rule your organization has set.
FOUR PATTERNS WORTH RECOGNIZING
Each starts with a reasonable request. The threat shows up only when you connect the action to the task, the authority and the history.
01 / ACTION CHAINS
An agent reads contracts, assumes a finance-admin role and attempts a payment. Each operation has to be judged against the original task.
Task intent + action historySee action chain exploitation02 / SCOPE
An agent can retrieve a document, but the intended recipient may be outside the permitted scope.
Identity + data policy + recipientSee contextual scope bypass03 / MEMORY
A changed memory or retrieved instruction can quietly redirect later work. The final call may look routine in isolation.
Memory + provenance + prior behaviorSee slow state corruption04 / DELEGATION
A downstream agent treats another agent’s request as permission to act. The original user never granted that scope.
Delegation chain + original authoritySee inter-agent exploitationACKUITY RESEARCH
Four broad classes. 21 threat vectors.
BRING A FRAMEWORK TO YOUR SECURITY REVIEW
Use our research to structure your assessment. The 14 categories above extend it with our newer threat models.
Read the researchPUT CONTEXT TO THE TEST
Try three illustrative agent-action scenarios. Find the context that changes the decision.
YOUR QUESTIONS, ANSWERED
AI agent risks include prompt injection, unsafe tool use, memory poisoning, privilege misuse, sensitive data exposure and compromised delegation. Assessing them requires looking at the agent’s permissions, connected systems and sequence of actions, as well as its inputs.
A prompt can be legitimate while a later action exceeds the task’s scope. For example, preparing a finance summary does not authorize a role change or payment. The relevant checks include intent, identity, permissions and earlier actions.
Ackuity checks each agent action against 60+ threat models in 14 categories, mapped to NIST, OWASP and MITRE ATLAS. The mapping supports your security review. It is not a certification.
Only the ones that pass through it. An MCP gateway governs the calls routed to it, but agents also act through CLI commands, SQL, raw HTTP, memory writes and agent-to-agent hand-offs that never reach it. Ackuity checks those actions too, and can pass the context it builds back to the gateway.
No. The response depends on severity, confidence, your policy and how Ackuity is deployed. Observe-only event pull reports findings without stopping anything. The sidecar can constrain, block or send an action to a person before it runs.
NEXT STEP
Start with read-only discovery. Leave with findings your engineering and security teams can act on.