Summary: The single-agent and multi-agent component model OWASP uses as the canvas for agentic threat modelling, plus the nine agentic patterns it defines to standardise threat-modelling vocabulary.
Sources: raw/Agentic/Agentic-AI-Threats-and-Mitigations-1.1.pdf
Last updated: 2026-07-29
The architecture exists to give threats somewhere to attach. OWASP declines to use STRIDE or MAESTRO and instead maps threats onto components, so the component list is the attack surface list.
A competing decomposition is now in the vault. MAESTRO cuts the same systems into seven horizontal layers rather than components, and reaches surfaces this model has no place for — infrastructure, the agent marketplace, and the security tooling itself. It also lacks a memory surface, which this model treats as central. The mapping and the four substantive disagreements are on maestro-asi-crosswalk.
What an agent is
Russell and Norvig’s definition is taken as the baseline: an intelligent agent “acts appropriately for its circumstances and its goals, is flexible to changing environments and goals, learns from experience, and makes appropriate choices given its perceptual and computational limitations” (AIMA 4th ed., p. 34, quoted at p. 4).
Agentic AI predates LLMs — the document credits OpenAI Gym (now Farama Gymnasium) with driving the first wave, and notes reinforcement learning now serves “as a mechanism to improve training and reasoning, not core reasoning” (p. 4). What changed is that LLMs became the reasoning engine deciding application control flow.
Three core capabilities
Planning & Reasoning — formulating, tracking and updating action plans; the ReAct (Reason + Act) pattern. Enabled by:
- Reflection — evaluating past actions to determine future ones, with self-critic as the component that critiques its own reasoning to find errors.
- Chain of Thought — decomposition into sequential logical steps, potentially without human interaction.
- Subgoal Decomposition — splitting a goal into milestones.
Memory / Statefulness — retaining information across previous runs or previous steps in the current run: “the reasoning behind their actions, tools they called, the information they retrieved.” Session-based short-term, or persistent long-term (p. 5).
Action and Tool Use — built-in tools (web browsing, calculation, code execution) and external tools via API. The document names MCP here: it “defines a standardized interface to connect an Agent (MCP Client) with a tool (MCP Server)” (p. 5). Function calling is treated as a specialised form of tool use.
The document also flags growing use of Small Language Models — under 10B parameters — as sufficiently capable for agentic work at lower cost (p. 5).
Single-agent components
The deployable components, which are also the threat-modelling boundaries (p. 8–9):
- The application — embeds agentic functionality, acts for the user “often outside a specific user session.”
- Input surface — natural language prompts plus optional media: files, images, sound, video.
- One or more LLM models, local or remote, used for reasoning.
- Services — built-in functions, local tools, local application code, external services. Invoked either (a) by function calling at the framework/application level, or (b) by the model returning invocation code to the agent.
- Supporting services — external storage for long-term memory; vector databases and other RAG sources.
Distinction (4a) versus (4b) matters for tool misuse and unexpected RCE: when the model emits code the agent executes, the trust boundary moves inside the model output.
The document is candid that this is a modelling convenience — “most agent deployments integrate these capabilities within the software itself rather than exposing them as independent services” (p. 8). The components are conceptual seams, not necessarily process boundaries.
Multi-agent additions
A multi-agent system is the same architecture plus inter-agent communication and, optionally, a coordinating agent. The A2A (Agent2Agent) protocol is named as the standard specification for that communication (p. 9). Both A2A and MCP are the subject of T16.
Adding these two elements is what activates T12, T13 and T14 — see multi-agent-threats.
The nine agentic patterns
Provided “to help standardize conversations in threat modeling” (pp. 10–11). Useful because each pattern implies a threat profile:
| Pattern | Description | Threat weight |
|---|---|---|
| Reflective Agent | Iteratively evaluates and critiques its own outputs | T5, T6 (reflection loop traps) |
| Task-Oriented Agent | Specific tasks, clear objectives | Lowest — narrow scope |
| Hierarchical Agent | Hierarchy managing multi-step workflows | T3, T14 (delegation chains) |
| Coordinating Agent | Assigns subtasks to specialists, tracks execution | T12, T13, T14 |
| Distributed Agent Ecosystem | Decentralised; IoT, marketplaces | T13 (no central monitoring) |
| Human-in-the-Loop Collaboration | Semi-autonomous with human oversight | T10, T15 |
| Self-Learning and Adaptive | Adapts from interactions and feedback | T1 (persistent memory drift) |
| RAG-Based Agent | Dynamic external knowledge retrieval | T1, T5, LLM08 |
| Planning Agent | Devises and executes multi-step plans | T6 |
| Context-Aware Agent | Adjusts behaviour to operating context | T6 |
The threat-weight column is this wiki’s inference from the taxonomy, not OWASP’s — the source gives descriptions and examples only.
MAESTRO enumerates eight patterns of its own, six of which share these names. Its additions — Sybil attack against the distributed ecosystem, and one canonical threat per pattern — are compared in maestro-asi-crosswalk. The four patterns unique to OWASP (Reflective, RAG-Based, Planning, Context-Aware) are all about the agent’s internal reasoning, which MAESTRO’s layered model does not reach.
Named frameworks: LangChain/LangFlow, AutoGen, CrewAI (p. 6). OWASP maintains an Agentic AI Landscape guide and a GitHub repository of “intentionally built vulnerable agents” for each.
Related pages
- agentic-threat-taxonomy — the threats mapped onto this architecture
- agentic-ai-threats-and-mitigations — the source page
- inter-agent-protocol-abuse — MCP and A2A as attack surface
- multi-agent-threats — what the second agent adds
- maestro-seven-layers — the competing layered decomposition
- maestro-asi-crosswalk — the two models mapped against each other