AI Agent Security Series: 2. Deriving the Attack Surfaces

Mon, 12 Oct 2026 00:00:00 +0000

In December 2025, OWASP released the 2026 edition of its Agentic Applications Top 10 [1], consolidating the threats to agentic applications into a standard list; the derivation below uses it as a reference.

The first article took the agent runtime apart into six layers and two components and left behind two structural facts: structural fact 1 is that all external content converges at assembly into one flat token stream with no provenance markers, and structural fact 2 is that the permission checkpoint covers only the model-to-action segment, so content ingestion and configuration loading never pass through it. Derived along that structural diagram, the attack surfaces differ from the threat list: their value lies in testability, in that any new vulnerability or new technique can be located on one of the attack surfaces, while whatever fails to locate exposes a gap in the structural diagram, and both outcomes advance understanding. Once the derivation is done, the ten OWASP categories are placed back onto the seven attack surfaces one by one, and the relation between the threat list and the structural diagram becomes clear.

Threat-Modeling on iamelli0t's blog

AI Agent Security Series: 2. Deriving the Attack Surfaces