From 33df354ed3eaa6595860d7e326f53d9b2d0d6857 Mon Sep 17 00:00:00 2001
From: Rodion Kostin <rodion.kostin.999@gmail.com>
Date: Wed, 2 Apr 2025 12:41:37 +0300
Subject: [PATCH 1/2] Add agents' automative threat detection

---
 .gitignore                                    |    4 +
 td.vue/public/assets/agent-tool.svg           |    5 +
 td.vue/public/assets/agent.svg                |    8 +
 td.vue/src/components/GraphButtons.vue        |   21 +
 td.vue/src/components/GraphProperties.vue     |   33 +
 td.vue/src/components/Navbar.vue              |    4 +-
 td.vue/src/i18n/en.js                         |   11 +-
 td.vue/src/i18n/ru.js                         |    3 +
 td.vue/src/plugins/fontawesome-vue.js         |    6 +-
 .../src/service/entity/default-properties.js  |   93 +-
 td.vue/src/service/threats/analyzer/index.js  |  113 ++
 .../src/service/threats/analyzer/threats.json | 1197 +++++++++++++++++
 td.vue/src/service/x6/shapes/agent-tool.js    |   43 +
 td.vue/src/service/x6/shapes/agent.js         |   43 +
 td.vue/src/service/x6/shapes/index.js         |    3 +
 td.vue/src/service/x6/stencil.js              |    3 +
 .../unit/service/x6/shapes/agent.spec.js      |   35 +
 17 files changed, 1594 insertions(+), 31 deletions(-)
 create mode 100644 td.vue/public/assets/agent-tool.svg
 create mode 100644 td.vue/public/assets/agent.svg
 create mode 100644 td.vue/src/service/threats/analyzer/index.js
 create mode 100644 td.vue/src/service/threats/analyzer/threats.json
 create mode 100644 td.vue/src/service/x6/shapes/agent-tool.js
 create mode 100644 td.vue/src/service/x6/shapes/agent.js
 create mode 100644 td.vue/tests/unit/service/x6/shapes/agent.spec.js

diff --git a/.gitignore b/.gitignore
index 0c772efd4..f33079396 100644
--- a/.gitignore
+++ b/.gitignore
@@ -94,6 +94,7 @@
 !td.vue/**/*.scss
 !td.vue/public/
 !td.vue/public/*
+!td.vue/public/**
 !td.vue/src/
 !td.vue/src/*.js
 !td.vue/src/*.vue
@@ -141,6 +142,9 @@
 !td.vue/src/service/threats/models/*.js
 !td.vue/src/service/threats/oats/
 !td.vue/src/service/threats/oats/*.js
+!td.vue/src/service/threats/analyzer/
+!td.vue/src/service/threats/analyzer/*.js
+!td.vue/src/service/threats/analyzer/*.json
 !td.vue/src/service/x6/
 !td.vue/src/service/x6/*.js
 !td.vue/src/service/x6/graph/
diff --git a/td.vue/public/assets/agent-tool.svg b/td.vue/public/assets/agent-tool.svg
new file mode 100644
index 000000000..0ff08485c
--- /dev/null
+++ b/td.vue/public/assets/agent-tool.svg
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?><!-- Uploaded to: SVG Repo, www.svgrepo.com, Generator: SVG Repo Mixer Tools -->
+<svg width="800px" height="800px" viewBox="-0.5 0 25 25" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M10.3365 12.3022C8.94652 13.1922 7.10652 13.2022 5.70652 12.3222C4.17652 11.3622 3.48652 9.72224 3.61652 8.14224C3.65652 7.64224 4.25653 7.41224 4.60653 7.76224L6.27653 9.44225C6.49653 9.67225 6.86653 9.67225 7.09653 9.44225L8.97652 7.54224C9.20652 7.31224 9.20652 6.94225 8.97652 6.72225L7.30652 5.04224C6.95652 4.69224 7.18652 4.08224 7.67652 4.04224C8.92652 3.94224 10.2165 4.36224 11.1665 5.32224C13.1365 7.31224 12.8565 10.7022 10.3365 12.3022Z" stroke="#0F0F0F" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M13.8966 11.7523L20.2566 18.1223C20.4466 18.3223 20.4466 18.6323 20.2566 18.8223L18.2666 20.8223C18.0666 21.0223 17.7466 21.0223 17.5566 20.8223L11.2266 14.4223" stroke="#0F0F0F" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
\ No newline at end of file
diff --git a/td.vue/public/assets/agent.svg b/td.vue/public/assets/agent.svg
new file mode 100644
index 000000000..ea1de1041
--- /dev/null
+++ b/td.vue/public/assets/agent.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?><!-- Uploaded to: SVG Repo, www.svgrepo.com, Generator: SVG Repo Mixer Tools -->
+<svg width="800px" height="800px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M9 15C8.44771 15 8 15.4477 8 16C8 16.5523 8.44771 17 9 17C9.55229 17 10 16.5523 10 16C10 15.4477 9.55229 15 9 15Z" fill="#0F0F0F"/>
+<path d="M14 16C14 15.4477 14.4477 15 15 15C15.5523 15 16 15.4477 16 16C16 16.5523 15.5523 17 15 17C14.4477 17 14 16.5523 14 16Z" fill="#0F0F0F"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M12 1C10.8954 1 10 1.89543 10 3C10 3.74028 10.4022 4.38663 11 4.73244V7H6C4.34315 7 3 8.34315 3 10V20C3 21.6569 4.34315 23 6 23H18C19.6569 23 21 21.6569 21 20V10C21 8.34315 19.6569 7 18 7H13V4.73244C13.5978 4.38663 14 3.74028 14 3C14 1.89543 13.1046 1 12 1ZM5 10C5 9.44772 5.44772 9 6 9H7.38197L8.82918 11.8944C9.16796 12.572 9.86049 13 10.618 13H13.382C14.1395 13 14.832 12.572 15.1708 11.8944L16.618 9H18C18.5523 9 19 9.44772 19 10V20C19 20.5523 18.5523 21 18 21H6C5.44772 21 5 20.5523 5 20V10ZM13.382 11L14.382 9H9.61803L10.618 11H13.382Z" fill="#0F0F0F"/>
+<path d="M1 14C0.447715 14 0 14.4477 0 15V17C0 17.5523 0.447715 18 1 18C1.55228 18 2 17.5523 2 17V15C2 14.4477 1.55228 14 1 14Z" fill="#0F0F0F"/>
+<path d="M22 15C22 14.4477 22.4477 14 23 14C23.5523 14 24 14.4477 24 15V17C24 17.5523 23.5523 18 23 18C22.4477 18 22 17.5523 22 17V15Z" fill="#0F0F0F"/>
+</svg>
\ No newline at end of file
diff --git a/td.vue/src/components/GraphButtons.vue b/td.vue/src/components/GraphButtons.vue
index 22dd356dd..f5b1f08d9 100644
--- a/td.vue/src/components/GraphButtons.vue
+++ b/td.vue/src/components/GraphButtons.vue
@@ -1,5 +1,12 @@
 <template>
     <b-btn-group>
+
+        <td-form-button
+            :onBtnClick="generateThreats"
+            icon="magic-wand-sparkles"
+            :title="$t('threatmodel.buttons.generateThreats')"
+            text="" />
+
         <td-form-button
             :onBtnClick="deleteSelected"
             icon="trash"
@@ -73,6 +80,8 @@
 import { mapState } from 'vuex';
 
 import TdFormButton from '@/components/FormButton.vue';
+import { completeGraphAgentThreats } from '@/service/threats/analyzer/index.js';
+
 
 export default {
     name: 'TdGraphButtons',
@@ -80,7 +89,16 @@ export default {
         TdFormButton
     },
     computed: mapState({
+        cellRef: (state) => state.cell.ref,
+        threats: (state) => state.cell.threats,
         diagram: (state) => state.threatmodel.selectedDiagram,
+        threatTop: (state) => state.threatmodel.data.detail.threatTop,
+        disableNewThreat: function (state) {
+            if (!state.cell?.ref?.data) {
+                return true;
+            }
+            return state.cell.ref.data.outOfScope || state.cell.ref.data.isTrustBoundary || state.cell.ref.data.type === 'tm.Text';
+        }
     }),
     data() {
         return {
@@ -93,6 +111,9 @@ export default {
         }
     },
     methods: {
+        generateThreats() {
+            completeGraphAgentThreats(this.graph, this.$store);
+        },
         save() {
             this.$emit('saved');
         },
diff --git a/td.vue/src/components/GraphProperties.vue b/td.vue/src/components/GraphProperties.vue
index fc3f87044..f37dd3e4e 100644
--- a/td.vue/src/components/GraphProperties.vue
+++ b/td.vue/src/components/GraphProperties.vue
@@ -242,6 +242,22 @@
             >
           </b-form-group>
         </b-col>
+
+        <!-- Auto properties -->
+        <b-col 
+            v-if="cellRef.data.type in properties"
+            v-for="prop in properties[cellRef.data.type]" 
+            :key="`${cellRef.data.type}_${prop.key}`">
+          <b-form-group label-cols="auto" :id="`${prop.key}-group`">
+            <component
+              :is="propertyTypeComponents[prop.type]"
+              :id="prop.key"
+              v-model="cellRef.data[prop.key]"
+              @change="onChangeProperties()"
+              >{{ $t(`threatmodel.properties.${prop.key}`) }}</component>
+          </b-form-group>
+        </b-col>
+
       </b-form-row>
     </b-form>
   </div>
@@ -259,6 +275,23 @@ import dataChanged from '@/service/x6/graph/data-changed.js';
 
 export default {
     name: 'TdGraphProperties',
+    data: () => ({
+        properties: {
+            'tm.Agent': [
+                { key: 'pQueryRewriting', type: 'bool' },
+                { key: 'pPromptTemplate', type: 'bool' },
+                { key: 'pAttachInstruction', type: 'bool' },
+                { key: 'pOutputSafetyFilter', type: 'bool' },
+                { key: 'pModifiesMemory', type: 'bool' },
+            ],
+            'tm.Flow': [
+                { key: 'pRawUserData', type: 'bool' },
+            ]
+        },
+        propertyTypeComponents: {
+            bool: 'b-form-checkbox'
+        }
+    }),
     computed: mapState({
         cellRef: (state) => state.cell.ref
     }),
diff --git a/td.vue/src/components/Navbar.vue b/td.vue/src/components/Navbar.vue
index 31bb883fd..3db65f05f 100644
--- a/td.vue/src/components/Navbar.vue
+++ b/td.vue/src/components/Navbar.vue
@@ -22,6 +22,7 @@
             v-b-tooltip.hover :title="$t('nav.logOut')"
           ></font-awesome-icon>
         </b-nav-item>
+
         <b-nav-item
           href="https://owasp.org/www-project-threat-dragon/docs-2/"
           target="_blank"
@@ -136,7 +137,8 @@ export default {
                     throw error;
                 }
             });
-        }
+        },
+
     }
 };
 </script>
diff --git a/td.vue/src/i18n/en.js b/td.vue/src/i18n/en.js
index 5bfa2a193..0922d4e74 100644
--- a/td.vue/src/i18n/en.js
+++ b/td.vue/src/i18n/en.js
@@ -181,10 +181,17 @@ const eng = {
             protocol: 'Protocol',
             publicNetwork: 'Public Network',
             storesCredentials: 'Stores Credentials',
-            storesInventory: 'Stores Inventory'
+            storesInventory: 'Stores Inventory',
+            pQueryRewriting: 'Query Rewriting',
+            pPromptTemplate: 'Prompt Template',
+            pAttachInstruction: 'Attach Instruction',
+            pOutputSafetyFilter: 'Output Safety Filter',
+            pModifiesMemory: 'Modifies Memory',
+            pRawUserData: 'Raw User Data',
         },
         buttons: {
             delete: 'Delete selected',
+            generateThreats: 'Generate threats',
             redo: 'Redo edit',
             shortcuts: 'Keyboard shortcuts',
             toggleGrid: 'Toggle grid',
@@ -241,6 +248,8 @@ const eng = {
         },
         shapes: {
             actor: 'Actor',
+            agent: 'Agent',
+            tool: 'Tool',
             flow: 'Data Flow',
             flowStencil: 'Data Flow',
             process: 'Process',
diff --git a/td.vue/src/i18n/ru.js b/td.vue/src/i18n/ru.js
index b000323ff..cd154eab2 100644
--- a/td.vue/src/i18n/ru.js
+++ b/td.vue/src/i18n/ru.js
@@ -180,6 +180,7 @@ const rus = {
         },
         buttons: {
             delete: 'Delete selected',
+            generateThreats: 'Generate threats',
             redo: 'Redo edit',
             shortcuts: 'Keyboard shortcuts',
             toggleGrid: 'Toggle grid',
@@ -236,6 +237,8 @@ const rus = {
         },
         shapes: {
             actor: 'Actor',
+            agent: 'Agent',
+            tool: 'Tool',
             flow: 'Data Flow',
             flowStencil: 'Data Flow',
             process: 'Process',
diff --git a/td.vue/src/plugins/fontawesome-vue.js b/td.vue/src/plugins/fontawesome-vue.js
index 9c954904b..6b9076ba2 100644
--- a/td.vue/src/plugins/fontawesome-vue.js
+++ b/td.vue/src/plugins/fontawesome-vue.js
@@ -31,7 +31,8 @@ import {
     faPrint,
     faProjectDiagram,
     faDiagramProject,
-    faLock
+    faLock,
+    faMagicWandSparkles
 } from '@fortawesome/free-solid-svg-icons';
 
 import {faBitbucket, faGithub, faGitlab, faVuejs, faGoogle, faGoogleDrive} from '@fortawesome/free-brands-svg-icons';
@@ -70,7 +71,8 @@ library.add(
     faDiagramProject,
     faGoogle,
     faGoogleDrive,
-    faLock
+    faLock,
+    faMagicWandSparkles
 );
 
 Vue.component('font-awesome-icon', FontAwesomeIcon);
diff --git a/td.vue/src/service/entity/default-properties.js b/td.vue/src/service/entity/default-properties.js
index e972e6097..c7eb41396 100644
--- a/td.vue/src/service/entity/default-properties.js
+++ b/td.vue/src/service/entity/default-properties.js
@@ -1,28 +1,3 @@
-const actor = {
-    type: 'tm.Actor',
-    name: 'Actor',
-    description: '',
-    outOfScope: false,
-    reasonOutOfScope: '',
-    hasOpenThreats: false,
-    providesAuthentication: false,
-    threats: []
-};
-
-const boundary = {
-    type: 'tm.Boundary',
-    name: 'Trust Boundary',
-    description: '',
-    isTrustBoundary: true
-};
-
-const boundaryBox = {
-    type: 'tm.BoundaryBox',
-    name: 'Trust Boundary',
-    description: '',
-    isTrustBoundary: true
-};
-
 const flow = {
     type: 'tm.Flow',
     name: 'Data Flow',
@@ -34,9 +9,22 @@ const flow = {
     isEncrypted: false,
     isPublicNetwork: false,
     protocol: '',
+    pRawUserData: false,
     threats: []
 };
 
+const actor = {
+    type: 'tm.Actor',
+    name: 'Actor',
+    description: '',
+    outOfScope: false,
+    reasonOutOfScope: '',
+    hasOpenThreats: false,
+    providesAuthentication: false,
+    threats: [],
+    isTrusted: false
+};
+
 const tmProcess = {
     type: 'tm.Process',
     name: 'Process',
@@ -48,7 +36,8 @@ const tmProcess = {
     handlesGoodsOrServices: false,
     isWebApplication: false,
     privilegeLevel: '',
-    threats: []
+    threats: [],
+    isTrusted: false
 };
 
 const store = {
@@ -63,16 +52,65 @@ const store = {
     isSigned: false,
     storesCredentials: false,
     storesInventory: false,
-    threats: []
+    threats: [],
+    isTrusted: false
+};
+
+const agent = {
+    type: 'tm.Agent',
+    name: 'Agent',
+    description: '',
+    outOfScope: false,
+    reasonOutOfScope: '',
+    hasOpenThreats: false,
+    pQueryRewriting: false,
+    pPromptTemplate: false,
+    pAttachInstruction: false,
+    pOutputSafetyFilter: false,
+    pModifiesMemory: false,
+    threats: [],
+    isTrusted: false
 };
 
+const tool = {
+    type: 'tm.Tool',
+    name: 'Tool',
+    description: '',
+    outOfScope: false,
+    reasonOutOfScope: '',
+    hasOpenThreats: false,
+    pRequiresElevatedPrivileges: false,
+    threats: [],
+    isTrusted: false
+};
+
+
+
+
+
 const text = {
     type: 'tm.Text',
     name: 'Descriptive text'
 };
 
+const boundary = {
+    type: 'tm.Boundary',
+    name: 'Trust Boundary',
+    description: '',
+    isTrustBoundary: true
+};
+
+const boundaryBox = {
+    type: 'tm.BoundaryBox',
+    name: 'Trust Boundary',
+    description: '',
+    isTrustBoundary: true
+};
+
 const propsByType = {
     'tm.Actor': actor,
+    'tm.Agent': agent,
+    'tm.Tool': tool,
     'tm.Boundary': boundary,
     'tm.BoundaryBox': boundaryBox,
     'tm.Flow': flow,
@@ -91,6 +129,7 @@ const getByType = (type) => {
 
 export default {
     actor,
+    agent,
     boundary,
     boundaryBox,
     flow,
diff --git a/td.vue/src/service/threats/analyzer/index.js b/td.vue/src/service/threats/analyzer/index.js
new file mode 100644
index 000000000..09563a712
--- /dev/null
+++ b/td.vue/src/service/threats/analyzer/index.js
@@ -0,0 +1,113 @@
+import { v4 } from 'uuid';
+import dataChanged from '@/service/x6/graph/data-changed.js';
+import tmActions from '@/store/actions/threatmodel.js';
+import { CELL_DATA_UPDATED, CELL_SELECTED } from '@/store/actions/cell.js';
+import { CELL_UNSELECTED } from "../../../store/actions/cell.js";
+import threats from "./threats.json"
+
+function _updateTrust(graph) {
+    const boundaryBoxes = graph.getNodes().filter(cell => cell.data.type === 'tm.BoundaryBox');
+    const nodes = graph.getNodes().filter(cell => cell.data.type !== 'tm.BoundaryBox');
+    for (const node of nodes) {
+        const {x,y,width,height} = node.getBBox();
+        node.data.isTrusted = boundaryBoxes.some(tb => {
+            const {x: tbX, y: tbY, width: tbWidth, height: tbHeight} = tb.getBBox();
+            return x >= tbX && x + width <= tbX + tbWidth && y >= tbY && y + height <= tbY + tbHeight;
+        });
+    }
+}
+
+function _getCommonEdges(cell1, cell2, {graph}) {
+    const edge1 = graph.getConnectedEdges(cell1);
+    const edge2 = graph.getConnectedEdges(cell2);
+    return edge1.filter(edge => edge2.includes(edge));
+}
+
+function _isThreatApplicableToCell(cell, threat, {graph}) {
+    function _checkType(type, data) {
+        return type === data.type || type === 'any'
+    }
+    function _checkProps(props, data) {
+        return Object.entries(props).every(([key, value]) => data[key] === value);
+    }
+    function _checkDirection(direction, edge, neighbourCell) {
+        if (direction === 'any') return true;
+        console.log({edge, neighbourCell})
+        if (direction === 'to') return edge.target.cell === neighbourCell.id;
+        if (direction === 'from') return edge.source.cell === neighbourCell.id;
+        return false;
+    }
+    function _checkFlows(flows, cell, neighbourCell, {graph}) {
+        const commonEdges = _getCommonEdges(cell, neighbourCell, {graph});
+        console.log({commonEdges})
+        return flows.every(flow => {
+            return commonEdges.some(edge => {
+                if (!_checkDirection(flow.direction, edge, neighbourCell)) return false;
+                if (!_checkProps(flow.props, edge.data)) return false;
+                return true;
+            })
+        })
+    }
+    function _checkNeighbours(neighbours, cell, {graph}) {
+        const neighbourCells = graph.getNeighbors(cell)
+        return neighbours.every(neighbour => {
+            return neighbourCells.some(neighbourCell => {
+                if (!_checkType(neighbour.nodeType, neighbourCell.data)) return false;
+                if (!_checkProps(neighbour.props, neighbourCell.data)) return false;
+                if (!_checkFlows(neighbour.flows, cell, neighbourCell, {graph})) return false;
+                return true;
+            });
+        })
+    }
+
+    if (cell.data.threats.find(t => t.originId === threat.id)) {
+        return false;
+    }
+    for (const condition of threat.conditions) {
+        if (!_checkType(condition.nodeType, cell.data)) continue;
+        if (!_checkProps(condition.props, cell.data)) continue;
+        if (!_checkNeighbours(condition.neighbours, cell, {graph})) continue;
+        return true;
+    }
+    return false;
+}
+
+function _analyzeCellForThreats(cell, {graph, store}) {
+    return threats.filter(threat => _isThreatApplicableToCell(cell, threat, {graph})).map((threat,i) => ({
+            id: v4(),
+            originId: threat.id,
+            title: `AUTO: ${threat.name}`,
+            status: 'Open',
+            severity: 'TBD',
+            type: threat.strideType,
+            description: threat.description,
+            mitigation: threat.mitigations,
+            modelType: 'STRIDE',
+            new: true,
+            number: store.state.threatmodel.data.detail.threatTop + 1 + i,
+            score: ''
+        }));
+}
+
+function _addThreatsToCell(cell, threats, {store}) {
+    store.dispatch(CELL_SELECTED, cell);
+    cell.data.threats = [...cell.data.threats, ...threats];
+    cell.data.hasOpenThreats = cell.data.threats.length > 0;
+    store.dispatch(tmActions.update, { threatTop: store.state.threatmodel.data.detail.threatTop + threats.length });
+    store.dispatch(tmActions.modified);
+    store.dispatch(CELL_DATA_UPDATED, cell.data);
+    dataChanged.updateStyleAttrs(cell);
+}
+
+export function completeGraphAgentThreats(graph, store) {
+    console.log(graph);
+    _updateTrust(graph)
+    const cells = graph.getCells()
+    for (const cell of cells) {
+        if (!('threats' in cell.data)) continue;
+        const threats = _analyzeCellForThreats(cell, {store, graph});
+        _addThreatsToCell(cell, threats, {store});
+    }
+    store.dispatch(CELL_UNSELECTED);
+    graph.cleanSelection();
+}
diff --git a/td.vue/src/service/threats/analyzer/threats.json b/td.vue/src/service/threats/analyzer/threats.json
new file mode 100644
index 000000000..4394aead3
--- /dev/null
+++ b/td.vue/src/service/threats/analyzer/threats.json
@@ -0,0 +1,1197 @@
+[
+    {
+        "id": "TM-001",
+        "name": "Process sends raw user data to agent without query rewriting",
+        "description": "A process sends raw user data to an agent that does not perform query rewriting.",
+        "risks": "Agent may incorrectly process or misuse unsanitized input, enabling spoofing or tampering.",
+        "mitigations": "Enforce query rewriting or input validation in the agent.",
+        "strideType": "Tampering",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {
+              "pQueryRewriting": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Process",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "from",
+                    "props": {
+                      "pRawUserData": true
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-002",
+        "name": "Agent lacks query rewriting",
+        "description": "Agent receives input from a process without performing query rewriting.",
+        "risks": "Unsanitized input may lead to prompt injection or unintended behavior.",
+        "mitigations": "Implement strict query rewriting or input sanitization.",
+        "strideType": "Tampering",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {
+              "pQueryRewriting": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Process",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "from",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-003",
+        "name": "Agent provides responses without output safety filtering",
+        "description": "Agent returns responses without applying output safety filters.",
+        "risks": "May result in harmful, biased, or inappropriate output.",
+        "mitigations": "Integrate a robust output filtering mechanism.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {
+              "pOutputSafetyFilter": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Process",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-004",
+        "name": "Agent receives data over unencrypted flow",
+        "description": "Sensitive context data is sent to the agent over an unencrypted connection.",
+        "risks": "Data may be intercepted or modified in transit.",
+        "mitigations": "Enforce encryption (e.g., TLS) on all communication channels.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Store",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {
+                      "isEncrypted": false
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-005",
+        "name": "Agent receives context from unsigned data store",
+        "description": "Agent consumes context data from a store that does not sign its outputs.",
+        "risks": "Malicious data could be injected without detection.",
+        "mitigations": "Digitally sign data and validate integrity before usage.",
+        "strideType": "Tampering",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Store",
+                "props": {
+                  "isSigned": false
+                },
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-006",
+        "name": "Agent operates without prompt templating",
+        "description": "Agent does not use a structured prompt template when interacting with the LLM.",
+        "risks": "Inconsistent behavior or unintentional prompt injection.",
+        "mitigations": "Use standardized prompt templates to reduce variability.",
+        "strideType": "Tampering",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {
+              "pPromptTemplate": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Process",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "from",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-007",
+        "name": "Agent lacks instruction attachment to queries",
+        "description": "Agent does not attach usage or safety instructions to the model prompt.",
+        "risks": "Model may respond in unintended or unsafe ways.",
+        "mitigations": "Always attach clear instruction sets to each prompt.",
+        "strideType": "Spoofing",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {
+              "pAttachInstruction": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Process",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "from",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-008",
+        "name": "Agent uses data from public network without trust enforcement",
+        "description": "Agent communicates with external sources over public networks without verifying trust.",
+        "risks": "Data may be spoofed or manipulated in transit.",
+        "mitigations": "Enforce TLS and mutual authentication for all external communications.",
+        "strideType": "Spoofing",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Process",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "from",
+                    "props": {
+                      "isPublicNetwork": true,
+                      "isTrusted": false
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-101",
+        "name": "Store provides unsigned data to Agent",
+        "description": "The data store provides data to an agent without digital signature.",
+        "risks": "Data can be tampered with in transit or at rest without detection.",
+        "mitigations": "Ensure all data is signed and signatures are verified.",
+        "strideType": "Tampering",
+        "conditions": [
+          {
+            "nodeType": "tm.Store",
+            "props": {
+              "isSigned": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-102",
+        "name": "Store does not encrypt context sent to Agent",
+        "description": "The store transmits sensitive context to the agent without encryption.",
+        "risks": "Data may be intercepted during transmission.",
+        "mitigations": "Enable encryption for all outgoing data flows.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Store",
+            "props": {
+              "isEncrypted": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {
+                      "isEncrypted": false
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-103",
+        "name": "Store exposes credentials to Agent without verification",
+        "description": "The store releases stored credentials without ensuring the agent is authorized.",
+        "risks": "Credentials could be leaked or misused by unauthorized agents.",
+        "mitigations": "Implement access control and authentication checks.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Store",
+            "props": {
+              "storesCredentials": true
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {
+                  "isTrusted": false
+                },
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-104",
+        "name": "Store provides outdated or poisoned data to Agent",
+        "description": "The store lacks version control or validation, and the agent consumes incorrect data.",
+        "risks": "Leads to hallucinations or incorrect model responses.",
+        "mitigations": "Add data validation and freshness checks.",
+        "strideType": "Tampering",
+        "conditions": [
+          {
+            "nodeType": "tm.Store",
+            "props": {
+              "isALog": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-105",
+        "name": "Store lacks authentication before providing data to Agent",
+        "description": "The store does not authenticate the agent before sharing sensitive information.",
+        "risks": "An unauthorized agent may retrieve sensitive context.",
+        "mitigations": "Implement mutual authentication mechanisms.",
+        "strideType": "Spoofing",
+        "conditions": [
+          {
+            "nodeType": "tm.Store",
+            "props": {
+              "isTrusted": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {
+                  "providesAuthentication": false
+                },
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-106",
+        "name": "Store sends data to Agent over public network",
+        "description": "The store sends context to an agent using a flow marked as public.",
+        "risks": "Data may be exposed or modified by third parties.",
+        "mitigations": "Avoid using public networks or apply strong encryption.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Store",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {
+                      "isPublicNetwork": true
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-107",
+        "name": "Store feeds overly broad data to Agent",
+        "description": "The store sends excessive or unnecessary data to the agent.",
+        "risks": "Unneeded exposure increases attack surface and data leakage.",
+        "mitigations": "Filter and minimize context before sharing.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Store",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-108",
+        "name": "Store fails to log access by Agent",
+        "description": "No audit trail is recorded when the agent accesses data from the store.",
+        "risks": "Undetected misuse or compromise.",
+        "mitigations": "Enable logging and monitoring of all data accesses.",
+        "strideType": "Repudiation",
+        "conditions": [
+          {
+            "nodeType": "tm.Store",
+            "props": {
+              "isALog": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-109",
+        "name": "Store lacks redundancy for critical context used by Agent",
+        "description": "Single point of failure in the store causes agent malfunction when context is unavailable.",
+        "risks": "Agent unable to function or serve users correctly.",
+        "mitigations": "Introduce backup storage and failover mechanisms.",
+        "strideType": "Denial of Service",
+        "conditions": [
+          {
+            "nodeType": "tm.Store",
+            "props": {
+              "storesInventory": true
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-110",
+        "name": "Store sends data to Agent without validating schema",
+        "description": "The store sends inconsistent or unstructured data to the agent.",
+        "risks": "May lead to LLM errors or incorrect interpretations.",
+        "mitigations": "Enforce schema validation before sending data.",
+        "strideType": "Tampering",
+        "conditions": [
+          {
+            "nodeType": "tm.Store",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-201",
+        "name": "Backend sends data to Agent without verifying input integrity",
+        "description": "Backend sends user input to the agent without verifying if it's tampered or malformed.",
+        "risks": "Prompt injection, unsafe execution, or biased responses.",
+        "mitigations": "Validate and sanitize all input data before forwarding.",
+        "strideType": "Tampering",
+        "conditions": [
+          {
+            "nodeType": "tm.Process",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-202",
+        "name": "Backend receives agent responses without output validation",
+        "description": "Backend accepts and uses agent responses without validating or post-processing.",
+        "risks": "Malicious or harmful responses could reach the user.",
+        "mitigations": "Apply output filtering and safety checks.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Process",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {
+                  "pOutputSafetyFilter": false
+                },
+                "flows": [
+                  {
+                    "direction": "from",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-203",
+        "name": "Backend communicates with Agent without encryption",
+        "description": "Data exchanged between backend and agent is sent over unencrypted channels.",
+        "risks": "Eavesdropping, data manipulation in transit.",
+        "mitigations": "Use TLS or equivalent encryption protocols.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Process",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "any",
+                    "props": {
+                      "isEncrypted": false
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-204",
+        "name": "Backend accepts unsafe input from public network and passes to Agent",
+        "description": "Backend accepts unfiltered user input from a public network and forwards it to the agent.",
+        "risks": "Input may be spoofed or malicious.",
+        "mitigations": "Authenticate sources and sanitize data.",
+        "strideType": "Spoofing",
+        "conditions": [
+          {
+            "nodeType": "tm.Process",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              },
+              {
+                "nodeType": "tm.Actor",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "from",
+                    "props": {
+                      "isPublicNetwork": true
+                    }
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-205",
+        "name": "Backend fails to enforce role-based access before agent interaction",
+        "description": "The backend allows all users to trigger agent queries, regardless of role.",
+        "risks": "Unauthorized access to sensitive functions or data.",
+        "mitigations": "Implement role-based access control before querying agent.",
+        "strideType": "Elevation of Privilege",
+        "conditions": [
+          {
+            "nodeType": "tm.Process",
+            "props": {
+              "privilegeLevel": ""
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-206",
+        "name": "Backend over-exposes context to Agent",
+        "description": "Backend provides the agent with full user context without redaction.",
+        "risks": "Potential exposure of personal data or PII.",
+        "mitigations": "Apply data minimization and context redaction.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Process",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-207",
+        "name": "Backend sends improperly formatted input to Agent",
+        "description": "Input passed to the agent is missing required formatting or schema.",
+        "risks": "May result in unpredictable or incorrect behavior.",
+        "mitigations": "Implement strict input formatting standards.",
+        "strideType": "Tampering",
+        "conditions": [
+          {
+            "nodeType": "tm.Process",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {
+                  "pPromptTemplate": false
+                },
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-208",
+        "name": "Backend does not log queries to Agent",
+        "description": "Lack of logging means agent requests and outputs are not traceable.",
+        "risks": "Limits incident response and accountability.",
+        "mitigations": "Log all queries and responses securely.",
+        "strideType": "Repudiation",
+        "conditions": [
+          {
+            "nodeType": "tm.Process",
+            "props": {
+              "hasOpenThreats": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-209",
+        "name": "Backend exposes internal errors from Agent to user",
+        "description": "Error messages or stack traces are not filtered before being shown to the end-user.",
+        "risks": "Reveals sensitive system information that aids attackers.",
+        "mitigations": "Use generic error messages and log internal errors privately.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Process",
+            "props": {
+              "isWebApplication": true
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "from",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-210",
+        "name": "Backend sends redundant queries to Agent causing overload",
+        "description": "The backend does not rate-limit or de-duplicate queries sent to the agent.",
+        "risks": "Service degradation, latency, or denial of service.",
+        "mitigations": "Implement query throttling and caching.",
+        "strideType": "Denial of Service",
+        "conditions": [
+          {
+            "nodeType": "tm.Process",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Agent",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-009",
+        "name": "Agent handles context without access control",
+        "description": "Agent receives context data without verifying requester’s access rights.",
+        "risks": "Unauthorized access to sensitive or personal data.",
+        "mitigations": "Apply strict access control and identity verification.",
+        "strideType": "Information Disclosure",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Store",
+                "props": {
+                  "storesCredentials": true
+                },
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-010",
+        "name": "Agent receives unverified context injection from backend",
+        "description": "Backend sends context to the agent without verifying its origin or integrity.",
+        "risks": "Context could be maliciously crafted to mislead the model.",
+        "mitigations": "Validate and sanitize context before processing.",
+        "strideType": "Tampering",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {},
+            "neighbours": [
+              {
+                "nodeType": "tm.Process",
+                "props": {},
+                "flows": [
+                  {
+                    "direction": "from",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "TM-011",
+        "name": "Agent does not require elevated privileges but accesses sensitive data",
+        "description": "Agent is not configured with elevated privileges but accesses or processes sensitive information.",
+        "risks": "Privilege escalation or data misuse.",
+        "mitigations": "Review privilege configurations and enforce least privilege principle.",
+        "strideType": "Elevation of Privilege",
+        "conditions": [
+          {
+            "nodeType": "tm.Agent",
+            "props": {
+              "pRequiresElevatedPrivileges": false
+            },
+            "neighbours": [
+              {
+                "nodeType": "tm.Store",
+                "props": {
+                  "storesCredentials": true
+                },
+                "flows": [
+                  {
+                    "direction": "to",
+                    "props": {}
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      },
+      {
+          "id": "AG-MM-006",
+          "name": "Uncontrolled Context Growth",
+          "description": "Backend repeatedly sends long queries to the agent without limiting memory usage, leading to unsafe degradation of internal context.",
+          "risks": "Loss of system instructions, unstable outputs, denial of service.",
+          "mitigations": "Enforce context window limits, use structured prompt templates, implement memory reset logic.",
+          "strideType": "Denial of Service",
+          "conditions": [
+            {
+              "nodeType": "tm.Agent",
+              "props": {
+                "pPromptTemplate": false
+              },
+              "neighbours": [
+                {
+                  "nodeType": "tm.Process",
+                  "props": {},
+                  "flows": [
+                    {
+                      "direction": "from",
+                      "props": {}
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+    {
+      "id": "AG-001",
+      "name": "Compromised Agents",
+      "description": "Malicious AI agents designed to perform harmful actions, infiltrating the ecosystem by posing as legitimate services.",
+      "risks": "Execution of harmful actions within the ecosystem by trusted-looking malicious agents.",
+      "mitigations": "Require strong authentication for agents. Implement trust score thresholds for access.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {},
+          "neighbours": [
+            {
+              "nodeType": "tm.Process",
+              "props": {},
+              "flows": [
+                {
+                  "direction": "any",
+                  "props": {
+                    "outOfScope": true
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AG-002",
+      "name": "Excessive Agent Permissions",
+      "description": "Agent has more privileges than necessary, which may be exploited to access or modify sensitive data.",
+      "risks": "Unauthorized data access, data tampering, or privilege escalation.",
+      "mitigations": "Apply least privilege principle. Regularly audit agent permissions.",
+      "strideType": "Elevation of Privilege",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {
+            "providesAuthentication": true
+          },
+          "neighbours": [
+            {
+              "nodeType": "tm.Store",
+              "props": {
+                "storesCredentials": true
+              },
+              "flows": [
+                {
+                  "direction": "to",
+                  "props": {}
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AG-003",
+      "name": "Unverified Agent Output",
+      "description": "Agent generates output that is used without validation, enabling injection or manipulation attacks.",
+      "risks": "Injection into downstream systems or logic manipulation.",
+      "mitigations": "Sanitize and validate all agent-generated outputs before use.",
+      "strideType": "Tampering",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {},
+          "neighbours": [
+            {
+              "nodeType": "tm.Process",
+              "props": {},
+              "flows": [
+                {
+                  "direction": "from",
+                  "props": {
+                    "validated": false
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AG-004",
+      "name": "Data Disclosure via External Communication",
+      "description": "Agent communicates with external systems without encryption, exposing sensitive data.",
+      "risks": "Eavesdropping and data theft during transmission.",
+      "mitigations": "Enforce encryption and endpoint verification for external flows.",
+      "strideType": "Information Disclosure",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {},
+          "neighbours": [
+            {
+              "nodeType": "tm.Process",
+              "props": {
+                "outOfScope": true
+              },
+              "flows": [
+                {
+                  "direction": "any",
+                  "props": {
+                    "isEncrypted": false
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AG-005",
+      "name": "Unauthenticated Tool Usage",
+      "description": "Agent uses a tool that does not enforce authentication, allowing misuse or unauthorized access.",
+      "risks": "Malicious agents may exploit tools without validation, leading to security breaches.",
+      "mitigations": "Require tools to provide authentication and enforce agent identity verification.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {},
+          "neighbours": [
+            {
+              "nodeType": "tm.Tool",
+              "props": {
+                "providesAuthentication": false
+              },
+              "flows": [
+                {
+                  "direction": "any",
+                  "props": {}
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AG-006",
+      "name": "Agent Writes to Unsigned Logs",
+      "description": "Agent sends data to a log that is not signed, risking undetected tampering.",
+      "risks": "Log manipulation, loss of integrity and traceability.",
+      "mitigations": "Sign log storage. Use tamper-evident mechanisms.",
+      "strideType": "Tampering",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {},
+          "neighbours": [
+            {
+              "nodeType": "tm.Store",
+              "props": {
+                "isALog": true,
+                "isSigned": false
+              },
+              "flows": [
+                {
+                  "direction": "to",
+                  "props": {}
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AG-007",
+      "name": "Agent Reads Unencrypted Sensitive Store",
+      "description": "Agent accesses sensitive store that is not encrypted, risking data leakage.",
+      "risks": "Data exposure and regulatory non-compliance.",
+      "mitigations": "Encrypt all stores containing sensitive data.",
+      "strideType": "Information Disclosure",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {},
+          "neighbours": [
+            {
+              "nodeType": "tm.Store",
+              "props": {
+                "storesCredentials": true,
+                "isEncrypted": false
+              },
+              "flows": [
+                {
+                  "direction": "from",
+                  "props": {}
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AG-008",
+      "name": "Public API Abuse by Agent",
+      "description": "Agent communicates with public APIs without constraints, enabling unintended or malicious operations.",
+      "risks": "Service disruption, unauthorized actions, or data leakage.",
+      "mitigations": "Implement strict rate limiting, scope, and input filtering.",
+      "strideType": "Denial of Service",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {},
+          "neighbours": [
+            {
+              "nodeType": "tm.Process",
+              "props": {
+                "isWebApplication": true,
+                "outOfScope": true
+              },
+              "flows": [
+                {
+                  "direction": "to",
+                  "props": {
+                    "isPublicNetwork": true
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AG-009",
+      "name": "Agent Sends Data Without Encryption",
+      "description": "Agent sends data over an unencrypted channel, allowing eavesdropping and tampering.",
+      "risks": "Man-in-the-middle attacks, loss of data confidentiality.",
+      "mitigations": "Always enforce encryption on data flows.",
+      "strideType": "Information Disclosure",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {},
+          "neighbours": [
+            {
+              "nodeType": "tm.Process",
+              "props": {},
+              "flows": [
+                {
+                  "direction": "to",
+                  "props": {
+                    "isEncrypted": false
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AG-010",
+      "name": "Agent Interacts With External Actor Without Validation",
+      "description": "Agent receives input from actor without verifying source authenticity.",
+      "risks": "Spoofing, injection, or unexpected agent behavior.",
+      "mitigations": "Authenticate and validate actor inputs before processing.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {},
+          "neighbours": [
+            {
+              "nodeType": "tm.Actor",
+              "props": {
+                "providesAuthentication": false
+              },
+              "flows": [
+                {
+                  "direction": "from",
+                  "props": {}
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+  
\ No newline at end of file
diff --git a/td.vue/src/service/x6/shapes/agent-tool.js b/td.vue/src/service/x6/shapes/agent-tool.js
new file mode 100644
index 000000000..55c563c6e
--- /dev/null
+++ b/td.vue/src/service/x6/shapes/agent-tool.js
@@ -0,0 +1,43 @@
+import { Shape } from '@antv/x6';
+
+import { tc } from '@/i18n/index.js';
+
+import { ports } from '../ports.js';
+
+const name = 'agent-tool';
+
+// agent tool (image shape)
+export const ToolShape = Shape.Image.define({
+    constructorName: name,
+    width: 150,
+    height: 80,
+    zIndex: 0,
+    label: tc('threatmodel.shapes.tool'),
+    imageUrl: '/assets/agent-tool.svg',
+    attrs: {
+        image: {
+            width: 150,
+            height: 80,
+            refY: -8
+        },
+        label: {
+            refY: 53
+        }
+    },
+    ports: { ...ports }
+});
+
+ToolShape.prototype.type = 'tm.Tool';
+
+ToolShape.prototype.setName = function (name) {
+    this.label = name;
+};
+
+ToolShape.prototype.updateStyle = function (color, dash, strokeWidth) {
+    this.setAttrByPath('label/fill', color);
+};
+
+export default {
+    ToolShape,
+    name
+};
\ No newline at end of file
diff --git a/td.vue/src/service/x6/shapes/agent.js b/td.vue/src/service/x6/shapes/agent.js
new file mode 100644
index 000000000..f22cd2e9e
--- /dev/null
+++ b/td.vue/src/service/x6/shapes/agent.js
@@ -0,0 +1,43 @@
+import { Shape } from '@antv/x6';
+
+import { tc } from '@/i18n/index.js';
+
+import { ports } from '../ports.js';
+
+const name = 'agent';
+
+// agent (image shape)
+export const AgentShape = Shape.Image.define({
+    constructorName: name,
+    width: 150,
+    height: 80,
+    zIndex: 0,
+    label: tc('threatmodel.shapes.agent'),
+    imageUrl: '/assets/agent.svg',
+    attrs: {
+        image: {
+            width: 150,
+            height: 80,
+            refY: -7
+        },
+        label: {
+            refY: 60
+        }
+    },
+    ports: { ...ports }
+});
+
+AgentShape.prototype.type = 'tm.Agent';
+
+AgentShape.prototype.setName = function (name) {
+    this.label = name;
+};
+
+AgentShape.prototype.updateStyle = function (color, dash, strokeWidth) {
+    this.setAttrByPath('label/fill', color);
+};
+
+export default {
+    AgentShape,
+    name
+};
\ No newline at end of file
diff --git a/td.vue/src/service/x6/shapes/index.js b/td.vue/src/service/x6/shapes/index.js
index 708e372f5..32fb323f6 100644
--- a/td.vue/src/service/x6/shapes/index.js
+++ b/td.vue/src/service/x6/shapes/index.js
@@ -1,6 +1,7 @@
 import { Graph } from '@antv/x6';
 
 import { ActorShape } from './actor.js';
+import { AgentShape } from './agent.js';
 import { Flow } from './flow.js';
 import { FlowStencil } from './flow-stencil.js';
 import { ProcessShape } from './process.js';
@@ -14,6 +15,7 @@ import { TrustBoundaryCurveStencil } from './trust-boundary-curve-stencil.js';
 Graph.registerNode('trust-broundary-curve', TrustBoundaryCurve);
 
 Graph.registerNode('actor', ActorShape);
+Graph.registerNode('agent', AgentShape);
 Graph.registerEdge('flow', Flow);
 Graph.registerNode('process', ProcessShape);
 Graph.registerNode('store', StoreShape);
@@ -23,6 +25,7 @@ Graph.registerEdge('trust-boundary-curve', TrustBoundaryCurve);
 
 export default {
     ActorShape,
+    AgentShape,
     Flow,
     FlowStencil,
     ProcessShape,
diff --git a/td.vue/src/service/x6/stencil.js b/td.vue/src/service/x6/stencil.js
index 375ddcc3b..aa32ef6d1 100644
--- a/td.vue/src/service/x6/stencil.js
+++ b/td.vue/src/service/x6/stencil.js
@@ -1,6 +1,7 @@
 import shapes from './shapes/index.js';
 import { tc } from '@/i18n/index.js';
 import { Stencil as DefaultStencil } from '@antv/x6-plugin-stencil';
+import { ToolShape } from './shapes/agent-tool.js';
 
 const getStencilConfig = (target) => ({
     title: tc('threatmodel.stencil.entities'),
@@ -42,6 +43,8 @@ const get = (target, container, StencilClass = DefaultStencil) => {
             new shapes.ProcessShape(),
             new shapes.StoreShape(),
             new shapes.ActorShape(),
+            new shapes.AgentShape(),
+            new ToolShape(),
             new shapes.FlowStencil(),
         ],
         'components'
diff --git a/td.vue/tests/unit/service/x6/shapes/agent.spec.js b/td.vue/tests/unit/service/x6/shapes/agent.spec.js
new file mode 100644
index 000000000..ef53f3468
--- /dev/null
+++ b/td.vue/tests/unit/service/x6/shapes/agent.spec.js
@@ -0,0 +1,35 @@
+import { AgentShape } from '@/service/x6/shapes/agent.js';
+
+describe('service/x6/shapes/agent.js', () => {
+    let victim;
+
+    beforeEach(() => {
+        victim = new AgentShape();
+    });
+
+    it('creates an agent shape', () => {
+        expect(victim.constructor.name).toEqual('AgentShape');
+    });
+
+    it('has the correct type', () => {
+        expect(victim.type).toEqual('tm.Agent');
+    });
+
+    it('sets the name', () => {
+        const name = 'test agent';
+        victim.setName(name);
+        expect(victim.label).toEqual(name);
+    });
+
+    it('updates the style', () => {
+        const color = '#ff0000';
+        const dash = '5 5';
+        const width = 2;
+
+        victim.updateStyle(color, dash, width);
+
+        expect(victim.getAttrByPath('body/stroke')).toEqual(color);
+        expect(victim.getAttrByPath('body/strokeDasharray')).toEqual(dash);
+        expect(victim.getAttrByPath('body/strokeWidth')).toEqual(width);
+    });
+});
\ No newline at end of file

From 63a1755633cf23a95051c453fb6d8c93c74c3d3b Mon Sep 17 00:00:00 2001
From: Rodion Kostin <rodion.kostin.999@gmail.com>
Date: Wed, 30 Apr 2025 05:06:08 +0300
Subject: [PATCH 2/2] upd threats (in progress) according to OWASP Top 10 for
 LLM Apps & Gen AI Agentic Security Initiative

---
 .../src/service/entity/default-properties.js  |   24 +-
 .../src/service/threats/analyzer/threats.json | 1788 +++++++----------
 2 files changed, 709 insertions(+), 1103 deletions(-)

diff --git a/td.vue/src/service/entity/default-properties.js b/td.vue/src/service/entity/default-properties.js
index c7eb41396..ccc0fcbd8 100644
--- a/td.vue/src/service/entity/default-properties.js
+++ b/td.vue/src/service/entity/default-properties.js
@@ -10,7 +10,10 @@ const flow = {
     isPublicNetwork: false,
     protocol: '',
     pRawUserData: false,
-    threats: []
+    threats: [],
+    "isFunctionCall": false,
+    "isHighFrequency": false,
+    "resultsAreValidated": true
 };
 
 const actor = {
@@ -37,7 +40,10 @@ const tmProcess = {
     isWebApplication: false,
     privilegeLevel: '',
     threats: [],
-    isTrusted: false
+    isTrusted: false,
+    "hasShortTermMemory": false,
+    "hasLongTermMemory": false,
+    "executesGeneratedCode": false
 };
 
 const store = {
@@ -53,7 +59,8 @@ const store = {
     storesCredentials: false,
     storesInventory: false,
     threats: [],
-    isTrusted: false
+    isTrusted: false,
+    "isSharedContext": false
 };
 
 const agent = {
@@ -69,7 +76,11 @@ const agent = {
     pOutputSafetyFilter: false,
     pModifiesMemory: false,
     threats: [],
-    isTrusted: false
+    isTrusted: false,
+    "hasShortTermMemory": false,
+    "hasLongTermMemory": false,
+    "trustScore": 50,
+    "isRogue": false
 };
 
 const tool = {
@@ -81,7 +92,10 @@ const tool = {
     hasOpenThreats: false,
     pRequiresElevatedPrivileges: false,
     threats: [],
-    isTrusted: false
+    isTrusted: false,
+    "isExternal": false,
+    "isDangerous": false,
+    "requiresElevatedPrivileges": false
 };
 
 
diff --git a/td.vue/src/service/threats/analyzer/threats.json b/td.vue/src/service/threats/analyzer/threats.json
index 4394aead3..7d845ae6c 100644
--- a/td.vue/src/service/threats/analyzer/threats.json
+++ b/td.vue/src/service/threats/analyzer/threats.json
@@ -1,989 +1,83 @@
 [
     {
-        "id": "TM-001",
-        "name": "Process sends raw user data to agent without query rewriting",
-        "description": "A process sends raw user data to an agent that does not perform query rewriting.",
-        "risks": "Agent may incorrectly process or misuse unsanitized input, enabling spoofing or tampering.",
-        "mitigations": "Enforce query rewriting or input validation in the agent.",
-        "strideType": "Tampering",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {
-              "pQueryRewriting": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Process",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "from",
-                    "props": {
-                      "pRawUserData": true
-                    }
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-002",
-        "name": "Agent lacks query rewriting",
-        "description": "Agent receives input from a process without performing query rewriting.",
-        "risks": "Unsanitized input may lead to prompt injection or unintended behavior.",
-        "mitigations": "Implement strict query rewriting or input sanitization.",
-        "strideType": "Tampering",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {
-              "pQueryRewriting": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Process",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "from",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-003",
-        "name": "Agent provides responses without output safety filtering",
-        "description": "Agent returns responses without applying output safety filters.",
-        "risks": "May result in harmful, biased, or inappropriate output.",
-        "mitigations": "Integrate a robust output filtering mechanism.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {
-              "pOutputSafetyFilter": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Process",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-004",
-        "name": "Agent receives data over unencrypted flow",
-        "description": "Sensitive context data is sent to the agent over an unencrypted connection.",
-        "risks": "Data may be intercepted or modified in transit.",
-        "mitigations": "Enforce encryption (e.g., TLS) on all communication channels.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Store",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {
-                      "isEncrypted": false
-                    }
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-005",
-        "name": "Agent receives context from unsigned data store",
-        "description": "Agent consumes context data from a store that does not sign its outputs.",
-        "risks": "Malicious data could be injected without detection.",
-        "mitigations": "Digitally sign data and validate integrity before usage.",
-        "strideType": "Tampering",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Store",
-                "props": {
-                  "isSigned": false
-                },
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-006",
-        "name": "Agent operates without prompt templating",
-        "description": "Agent does not use a structured prompt template when interacting with the LLM.",
-        "risks": "Inconsistent behavior or unintentional prompt injection.",
-        "mitigations": "Use standardized prompt templates to reduce variability.",
-        "strideType": "Tampering",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {
-              "pPromptTemplate": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Process",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "from",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-007",
-        "name": "Agent lacks instruction attachment to queries",
-        "description": "Agent does not attach usage or safety instructions to the model prompt.",
-        "risks": "Model may respond in unintended or unsafe ways.",
-        "mitigations": "Always attach clear instruction sets to each prompt.",
-        "strideType": "Spoofing",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {
-              "pAttachInstruction": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Process",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "from",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-008",
-        "name": "Agent uses data from public network without trust enforcement",
-        "description": "Agent communicates with external sources over public networks without verifying trust.",
-        "risks": "Data may be spoofed or manipulated in transit.",
-        "mitigations": "Enforce TLS and mutual authentication for all external communications.",
-        "strideType": "Spoofing",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Process",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "from",
-                    "props": {
-                      "isPublicNetwork": true,
-                      "isTrusted": false
-                    }
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-101",
-        "name": "Store provides unsigned data to Agent",
-        "description": "The data store provides data to an agent without digital signature.",
-        "risks": "Data can be tampered with in transit or at rest without detection.",
-        "mitigations": "Ensure all data is signed and signatures are verified.",
-        "strideType": "Tampering",
-        "conditions": [
-          {
-            "nodeType": "tm.Store",
-            "props": {
-              "isSigned": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-102",
-        "name": "Store does not encrypt context sent to Agent",
-        "description": "The store transmits sensitive context to the agent without encryption.",
-        "risks": "Data may be intercepted during transmission.",
-        "mitigations": "Enable encryption for all outgoing data flows.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Store",
-            "props": {
-              "isEncrypted": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {
-                      "isEncrypted": false
-                    }
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-103",
-        "name": "Store exposes credentials to Agent without verification",
-        "description": "The store releases stored credentials without ensuring the agent is authorized.",
-        "risks": "Credentials could be leaked or misused by unauthorized agents.",
-        "mitigations": "Implement access control and authentication checks.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Store",
-            "props": {
-              "storesCredentials": true
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {
-                  "isTrusted": false
-                },
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-104",
-        "name": "Store provides outdated or poisoned data to Agent",
-        "description": "The store lacks version control or validation, and the agent consumes incorrect data.",
-        "risks": "Leads to hallucinations or incorrect model responses.",
-        "mitigations": "Add data validation and freshness checks.",
-        "strideType": "Tampering",
-        "conditions": [
-          {
-            "nodeType": "tm.Store",
-            "props": {
-              "isALog": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-105",
-        "name": "Store lacks authentication before providing data to Agent",
-        "description": "The store does not authenticate the agent before sharing sensitive information.",
-        "risks": "An unauthorized agent may retrieve sensitive context.",
-        "mitigations": "Implement mutual authentication mechanisms.",
-        "strideType": "Spoofing",
-        "conditions": [
-          {
-            "nodeType": "tm.Store",
-            "props": {
-              "isTrusted": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {
-                  "providesAuthentication": false
-                },
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-106",
-        "name": "Store sends data to Agent over public network",
-        "description": "The store sends context to an agent using a flow marked as public.",
-        "risks": "Data may be exposed or modified by third parties.",
-        "mitigations": "Avoid using public networks or apply strong encryption.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Store",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {
-                      "isPublicNetwork": true
-                    }
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-107",
-        "name": "Store feeds overly broad data to Agent",
-        "description": "The store sends excessive or unnecessary data to the agent.",
-        "risks": "Unneeded exposure increases attack surface and data leakage.",
-        "mitigations": "Filter and minimize context before sharing.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Store",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-108",
-        "name": "Store fails to log access by Agent",
-        "description": "No audit trail is recorded when the agent accesses data from the store.",
-        "risks": "Undetected misuse or compromise.",
-        "mitigations": "Enable logging and monitoring of all data accesses.",
-        "strideType": "Repudiation",
-        "conditions": [
-          {
-            "nodeType": "tm.Store",
-            "props": {
-              "isALog": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-109",
-        "name": "Store lacks redundancy for critical context used by Agent",
-        "description": "Single point of failure in the store causes agent malfunction when context is unavailable.",
-        "risks": "Agent unable to function or serve users correctly.",
-        "mitigations": "Introduce backup storage and failover mechanisms.",
-        "strideType": "Denial of Service",
-        "conditions": [
-          {
-            "nodeType": "tm.Store",
-            "props": {
-              "storesInventory": true
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-110",
-        "name": "Store sends data to Agent without validating schema",
-        "description": "The store sends inconsistent or unstructured data to the agent.",
-        "risks": "May lead to LLM errors or incorrect interpretations.",
-        "mitigations": "Enforce schema validation before sending data.",
-        "strideType": "Tampering",
-        "conditions": [
-          {
-            "nodeType": "tm.Store",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-201",
-        "name": "Backend sends data to Agent without verifying input integrity",
-        "description": "Backend sends user input to the agent without verifying if it's tampered or malformed.",
-        "risks": "Prompt injection, unsafe execution, or biased responses.",
-        "mitigations": "Validate and sanitize all input data before forwarding.",
-        "strideType": "Tampering",
-        "conditions": [
-          {
-            "nodeType": "tm.Process",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-202",
-        "name": "Backend receives agent responses without output validation",
-        "description": "Backend accepts and uses agent responses without validating or post-processing.",
-        "risks": "Malicious or harmful responses could reach the user.",
-        "mitigations": "Apply output filtering and safety checks.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Process",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {
-                  "pOutputSafetyFilter": false
-                },
-                "flows": [
-                  {
-                    "direction": "from",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-203",
-        "name": "Backend communicates with Agent without encryption",
-        "description": "Data exchanged between backend and agent is sent over unencrypted channels.",
-        "risks": "Eavesdropping, data manipulation in transit.",
-        "mitigations": "Use TLS or equivalent encryption protocols.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Process",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "any",
-                    "props": {
-                      "isEncrypted": false
-                    }
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-204",
-        "name": "Backend accepts unsafe input from public network and passes to Agent",
-        "description": "Backend accepts unfiltered user input from a public network and forwards it to the agent.",
-        "risks": "Input may be spoofed or malicious.",
-        "mitigations": "Authenticate sources and sanitize data.",
-        "strideType": "Spoofing",
-        "conditions": [
-          {
-            "nodeType": "tm.Process",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              },
-              {
-                "nodeType": "tm.Actor",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "from",
-                    "props": {
-                      "isPublicNetwork": true
-                    }
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-205",
-        "name": "Backend fails to enforce role-based access before agent interaction",
-        "description": "The backend allows all users to trigger agent queries, regardless of role.",
-        "risks": "Unauthorized access to sensitive functions or data.",
-        "mitigations": "Implement role-based access control before querying agent.",
-        "strideType": "Elevation of Privilege",
-        "conditions": [
-          {
-            "nodeType": "tm.Process",
-            "props": {
-              "privilegeLevel": ""
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-206",
-        "name": "Backend over-exposes context to Agent",
-        "description": "Backend provides the agent with full user context without redaction.",
-        "risks": "Potential exposure of personal data or PII.",
-        "mitigations": "Apply data minimization and context redaction.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Process",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-207",
-        "name": "Backend sends improperly formatted input to Agent",
-        "description": "Input passed to the agent is missing required formatting or schema.",
-        "risks": "May result in unpredictable or incorrect behavior.",
-        "mitigations": "Implement strict input formatting standards.",
-        "strideType": "Tampering",
-        "conditions": [
-          {
-            "nodeType": "tm.Process",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {
-                  "pPromptTemplate": false
-                },
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-208",
-        "name": "Backend does not log queries to Agent",
-        "description": "Lack of logging means agent requests and outputs are not traceable.",
-        "risks": "Limits incident response and accountability.",
-        "mitigations": "Log all queries and responses securely.",
-        "strideType": "Repudiation",
-        "conditions": [
-          {
-            "nodeType": "tm.Process",
-            "props": {
-              "hasOpenThreats": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-209",
-        "name": "Backend exposes internal errors from Agent to user",
-        "description": "Error messages or stack traces are not filtered before being shown to the end-user.",
-        "risks": "Reveals sensitive system information that aids attackers.",
-        "mitigations": "Use generic error messages and log internal errors privately.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Process",
-            "props": {
-              "isWebApplication": true
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "from",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-210",
-        "name": "Backend sends redundant queries to Agent causing overload",
-        "description": "The backend does not rate-limit or de-duplicate queries sent to the agent.",
-        "risks": "Service degradation, latency, or denial of service.",
-        "mitigations": "Implement query throttling and caching.",
-        "strideType": "Denial of Service",
-        "conditions": [
-          {
-            "nodeType": "tm.Process",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Agent",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-009",
-        "name": "Agent handles context without access control",
-        "description": "Agent receives context data without verifying requester’s access rights.",
-        "risks": "Unauthorized access to sensitive or personal data.",
-        "mitigations": "Apply strict access control and identity verification.",
-        "strideType": "Information Disclosure",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Store",
-                "props": {
-                  "storesCredentials": true
-                },
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-010",
-        "name": "Agent receives unverified context injection from backend",
-        "description": "Backend sends context to the agent without verifying its origin or integrity.",
-        "risks": "Context could be maliciously crafted to mislead the model.",
-        "mitigations": "Validate and sanitize context before processing.",
-        "strideType": "Tampering",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {},
-            "neighbours": [
-              {
-                "nodeType": "tm.Process",
-                "props": {},
-                "flows": [
-                  {
-                    "direction": "from",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "id": "TM-011",
-        "name": "Agent does not require elevated privileges but accesses sensitive data",
-        "description": "Agent is not configured with elevated privileges but accesses or processes sensitive information.",
-        "risks": "Privilege escalation or data misuse.",
-        "mitigations": "Review privilege configurations and enforce least privilege principle.",
-        "strideType": "Elevation of Privilege",
-        "conditions": [
-          {
-            "nodeType": "tm.Agent",
-            "props": {
-              "pRequiresElevatedPrivileges": false
-            },
-            "neighbours": [
-              {
-                "nodeType": "tm.Store",
-                "props": {
-                  "storesCredentials": true
-                },
-                "flows": [
-                  {
-                    "direction": "to",
-                    "props": {}
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      },
-      {
-          "id": "AG-MM-006",
-          "name": "Uncontrolled Context Growth",
-          "description": "Backend repeatedly sends long queries to the agent without limiting memory usage, leading to unsafe degradation of internal context.",
-          "risks": "Loss of system instructions, unstable outputs, denial of service.",
-          "mitigations": "Enforce context window limits, use structured prompt templates, implement memory reset logic.",
-          "strideType": "Denial of Service",
-          "conditions": [
-            {
-              "nodeType": "tm.Agent",
-              "props": {
-                "pPromptTemplate": false
-              },
-              "neighbours": [
-                {
-                  "nodeType": "tm.Process",
-                  "props": {},
-                  "flows": [
-                    {
-                      "direction": "from",
-                      "props": {}
-                    }
-                  ]
-                }
-              ]
-            }
-          ]
-        },
-    {
-      "id": "AG-001",
-      "name": "Compromised Agents",
-      "description": "Malicious AI agents designed to perform harmful actions, infiltrating the ecosystem by posing as legitimate services.",
-      "risks": "Execution of harmful actions within the ecosystem by trusted-looking malicious agents.",
-      "mitigations": "Require strong authentication for agents. Implement trust score thresholds for access.",
-      "strideType": "Spoofing",
+      "id": "T1-S1",
+      "name": "Travel-pricing Memory Poisoning",
+      "description": "False pricing rules gradually inserted into an agent’s long-term memory.",
+      "risks": "Repeated free or under-priced bookings, financial loss.",
+      "mitigations": "Validate memory writes, anomaly detection, rollback on poison signals.",
+      "strideType": "Tampering",
       "conditions": [
         {
           "nodeType": "tm.Agent",
-          "props": {},
+          "props": { "hasLongTermMemory": true },
           "neighbours": [
             {
-              "nodeType": "tm.Process",
-              "props": {},
-              "flows": [
-                {
-                  "direction": "any",
-                  "props": {
-                    "outOfScope": true
-                  }
-                }
-              ]
+              "nodeType": "tm.Store",
+              "props": { "isSharedContext": true, "isTrusted": false }
             }
           ]
         }
       ]
     },
     {
-      "id": "AG-002",
-      "name": "Excessive Agent Permissions",
-      "description": "Agent has more privileges than necessary, which may be exploited to access or modify sensitive data.",
-      "risks": "Unauthorized data access, data tampering, or privilege escalation.",
-      "mitigations": "Apply least privilege principle. Regularly audit agent permissions.",
-      "strideType": "Elevation of Privilege",
+      "id": "T1-S2",
+      "name": "Context-window Overflow",
+      "description": "Fragmented prompts exhaust short-term memory so privilege checks are forgotten.",
+      "risks": "Silent escalation and admin actions for attackers.",
+      "mitigations": "Session isolation, sliding-window validation.",
+      "strideType": "Tampering",
       "conditions": [
         {
           "nodeType": "tm.Agent",
-          "props": {
-            "providesAuthentication": true
-          },
-          "neighbours": [
-            {
-              "nodeType": "tm.Store",
-              "props": {
-                "storesCredentials": true
-              },
-              "flows": [
-                {
-                  "direction": "to",
-                  "props": {}
-                }
-              ]
-            }
-          ]
+          "props": { "hasShortTermMemory": true }
+        }
+      ]
+    },
+    {
+      "id": "T1-S3",
+      "name": "Security System Memory Drift",
+      "description": "Long-term memory of a security process is altered so that attacks look normal.",
+      "risks": "Persistent undetected intrusions.",
+      "mitigations": "Memory snapshots, truth-checking, dual-model audit.",
+      "strideType": "Tampering",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "hasLongTermMemory": true }
         }
       ]
     },
     {
-      "id": "AG-003",
-      "name": "Unverified Agent Output",
-      "description": "Agent generates output that is used without validation, enabling injection or manipulation attacks.",
-      "risks": "Injection into downstream systems or logic manipulation.",
-      "mitigations": "Sanitize and validate all agent-generated outputs before use.",
+      "id": "T1-S4",
+      "name": "Shared Session Poisoning",
+      "description": "Corrupt data placed in a store that many agents reuse as shared context.",
+      "risks": "Cross-user manipulation and data leakage.",
+      "mitigations": "Partition shared memory, require provenance tags.",
       "strideType": "Tampering",
+      "conditions": [
+        {
+          "nodeType": "tm.Store",
+          "props": { "isSharedContext": true, "isTrusted": false }
+        }
+      ]
+    },
+    {
+      "id": "T2-S1",
+      "name": "Tool Parameter Pollution",
+      "description": "Agent called with extra parameters that inflate a reservation from 1 seat to 500.",
+      "risks": "Unexpected cost spikes, DoS of capacity.",
+      "mitigations": "Strict schema validation, per-call rate limits.",
+      "strideType": "Elevation of Privilege",
       "conditions": [
         {
           "nodeType": "tm.Agent",
           "props": {},
           "neighbours": [
             {
-              "nodeType": "tm.Process",
-              "props": {},
+              "nodeType": "tm.Tool",
+              "props": { "isDangerous": true },
               "flows": [
-                {
-                  "direction": "from",
-                  "props": {
-                    "validated": false
-                  }
-                }
+                { "direction": "to", "props": { "isFunctionCall": true } }
               ]
             }
           ]
@@ -991,207 +85,705 @@
       ]
     },
     {
-      "id": "AG-004",
-      "name": "Data Disclosure via External Communication",
-      "description": "Agent communicates with external systems without encryption, exposing sensitive data.",
-      "risks": "Eavesdropping and data theft during transmission.",
-      "mitigations": "Enforce encryption and endpoint verification for external flows.",
-      "strideType": "Information Disclosure",
+      "id": "T2-S2",
+      "name": "Chained-tool Exfiltration",
+      "description": "Attacker steers customer-service agent to chain CRM and email tools to leak data.",
+      "risks": "Bulk data exfiltration that looks legitimate.",
+      "mitigations": "Track cross-tool workflows, require second-agent sign-off.",
+      "strideType": "Elevation of Privilege",
       "conditions": [
         {
           "nodeType": "tm.Agent",
-          "props": {},
+          "props": { "trustScore": { "$lt": 40 } },
           "neighbours": [
-            {
-              "nodeType": "tm.Process",
-              "props": {
-                "outOfScope": true
-              },
-              "flows": [
-                {
-                  "direction": "any",
-                  "props": {
-                    "isEncrypted": false
-                  }
-                }
-              ]
-            }
+            { "nodeType": "tm.Tool", "props": { "isExternal": true } }
           ]
         }
       ]
     },
     {
-      "id": "AG-005",
-      "name": "Unauthenticated Tool Usage",
-      "description": "Agent uses a tool that does not enforce authentication, allowing misuse or unauthorized access.",
-      "risks": "Malicious agents may exploit tools without validation, leading to security breaches.",
-      "mitigations": "Require tools to provide authentication and enforce agent identity verification.",
-      "strideType": "Spoofing",
+      "id": "T2-S3",
+      "name": "Document-Generator Abuse",
+      "description": "Document tool mis-used to mass-produce phishing content.",
+      "risks": "Large-scale spear-phishing campaigns.",
+      "mitigations": "Rate-limit generation, sandbox distribution channels.",
+      "strideType": "Elevation of Privilege",
+      "conditions": [
+        {
+          "nodeType": "tm.Tool",
+          "props": { "isDangerous": true, "requiresElevatedPrivileges": false }
+        }
+      ]
+    },
+    {
+      "id": "T3-S1",
+      "name": "Temporary Admin Retention",
+      "description": "AI is tricked into keeping troubleshooting privileges beyond the allowed window.",
+      "risks": "Persistent high-power access for attacker instructions.",
+      "mitigations": "JIT access tokens with hard expiry, differential audit.",
+      "strideType": "Elevation of Privilege",
       "conditions": [
         {
           "nodeType": "tm.Agent",
-          "props": {},
-          "neighbours": [
-            {
-              "nodeType": "tm.Tool",
-              "props": {
-                "providesAuthentication": false
-              },
-              "flows": [
-                {
-                  "direction": "any",
-                  "props": {}
-                }
-              ]
-            }
-          ]
+          "props": { "privilegeLevel": "admin" }
         }
       ]
     },
     {
-      "id": "AG-006",
-      "name": "Agent Writes to Unsigned Logs",
-      "description": "Agent sends data to a log that is not signed, risking undetected tampering.",
-      "risks": "Log manipulation, loss of integrity and traceability.",
-      "mitigations": "Sign log storage. Use tamper-evident mechanisms.",
-      "strideType": "Tampering",
+      "id": "T3-S2",
+      "name": "Cross-Domain Escalation",
+      "description": "HR agent’s credentials re-used to pull finance data via overlapping scopes.",
+      "risks": "Regulatory breach and fraud.",
+      "mitigations": "Scope isolation, purpose-built service tokens.",
+      "strideType": "Elevation of Privilege",
       "conditions": [
         {
           "nodeType": "tm.Agent",
           "props": {},
           "neighbours": [
-            {
-              "nodeType": "tm.Store",
-              "props": {
-                "isALog": true,
-                "isSigned": false
-              },
-              "flows": [
-                {
-                  "direction": "to",
-                  "props": {}
-                }
-              ]
-            }
+            { "nodeType": "tm.Tool", "props": { "requiresElevatedPrivileges": true } }
           ]
         }
       ]
     },
     {
-      "id": "AG-007",
-      "name": "Agent Reads Unencrypted Sensitive Store",
-      "description": "Agent accesses sensitive store that is not encrypted, risking data leakage.",
-      "risks": "Data exposure and regulatory non-compliance.",
-      "mitigations": "Encrypt all stores containing sensitive data.",
-      "strideType": "Information Disclosure",
+      "id": "T3-S3",
+      "name": "Shadow Agent Creation",
+      "description": "Attacker spawns a new agent inheriting an existing service identity.",
+      "risks": "Undetected malicious operations under trusted name.",
+      "mitigations": "Signed agent manifests, zero-trust launch controls.",
+      "strideType": "Elevation of Privilege",
       "conditions": [
         {
           "nodeType": "tm.Agent",
-          "props": {},
-          "neighbours": [
-            {
-              "nodeType": "tm.Store",
-              "props": {
-                "storesCredentials": true,
-                "isEncrypted": false
-              },
-              "flows": [
-                {
-                  "direction": "from",
-                  "props": {}
-                }
-              ]
-            }
-          ]
+          "props": { "isRogue": true }
         }
       ]
     },
     {
-      "id": "AG-008",
-      "name": "Public API Abuse by Agent",
-      "description": "Agent communicates with public APIs without constraints, enabling unintended or malicious operations.",
-      "risks": "Service disruption, unauthorized actions, or data leakage.",
-      "mitigations": "Implement strict rate limiting, scope, and input filtering.",
+      "id": "T4-S1",
+      "name": "Inference-Time Starvation",
+      "description": "Inputs force worst-case reasoning paths, hogging CPU/GPU.",
+      "risks": "Delayed or lost security detections.",
+      "mitigations": "Adaptive cost ceilings, early termination on hot-paths.",
+      "strideType": "Denial of Service",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "isWebApplication": true }
+        }
+      ]
+    },
+    {
+      "id": "T4-S2",
+      "name": "Multi-agent Computation Flood",
+      "description": "Many agents synchronously launch heavy tasks.",
+      "risks": "Exhaustion and cascading failures.",
+      "mitigations": "Quota per trust domain, circuit-breaker orchestration.",
       "strideType": "Denial of Service",
       "conditions": [
         {
           "nodeType": "tm.Agent",
           "props": {},
-          "neighbours": [
-            {
-              "nodeType": "tm.Process",
-              "props": {
-                "isWebApplication": true,
-                "outOfScope": true
-              },
-              "flows": [
-                {
-                  "direction": "to",
-                  "props": {
-                    "isPublicNetwork": true
-                  }
-                }
-              ]
-            }
+          "neighbours": [],
+          "flows": [
+            { "direction": "any", "props": { "isHighFrequency": true } }
           ]
         }
       ]
     },
     {
-      "id": "AG-009",
-      "name": "Agent Sends Data Without Encryption",
-      "description": "Agent sends data over an unencrypted channel, allowing eavesdropping and tampering.",
-      "risks": "Man-in-the-middle attacks, loss of data confidentiality.",
-      "mitigations": "Always enforce encryption on data flows.",
+      "id": "T4-S3",
+      "name": "API Quota Drain",
+      "description": "Prompt storm forces external service billing explosion and lock-out.",
+      "risks": "High cost and service unavailability for legit users.",
+      "mitigations": "Cost budgets, request shaping.",
+      "strideType": "Denial of Service",
+      "conditions": [
+        {
+          "nodeType": "tm.Flow",
+          "props": { "isHighFrequency": true, "isFunctionCall": true }
+        }
+      ]
+    },
+    {
+      "id": "T4-S4",
+      "name": "Memory Cascade Leak",
+      "description": "Lots of overlapping tasks fragment memory until nothing fits.",
+      "risks": "Crash and state loss.",
+      "mitigations": "Memory quotas, garbage-collection checkpoints.",
+      "strideType": "Denial of Service",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "hasShortTermMemory": true, "hasLongTermMemory": true }
+        }
+      ]
+    },
+    {
+      "id": "T5-S1",
+      "name": "Misinformation Snowball",
+      "description": "False product specs keep re-appearing and growing in confidence.",
+      "risks": "User deception, legal liability.",
+      "mitigations": "Cross-source fact checking, confidence decay.",
       "strideType": "Information Disclosure",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "hasLongTermMemory": true }
+        }
+      ]
+    },
+    {
+      "id": "T5-S2",
+      "name": "Phantom API Leakage",
+      "description": "Hallucinated endpoint causes disclosure of internal data when queried.",
+      "risks": "Accidental exposure of secrets.",
+      "mitigations": "Strict API allow-list, hallucination filter.",
+      "strideType": "Information Disclosure",
+      "conditions": [
+        {
+          "nodeType": "tm.Flow",
+          "props": { "isFunctionCall": true, "resultsAreValidated": false }
+        }
+      ]
+    },
+    {
+      "id": "T5-S3",
+      "name": "Bad Medical Advice Loop",
+      "description": "False guideline stored, reused, and amplified in each consultation.",
+      "risks": "Patient harm, malpractice.",
+      "mitigations": "External clinical guideline validation, human sign-off.",
+      "strideType": "Information Disclosure",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "hasLongTermMemory": true, "requiresHITL": true }
+        }
+      ]
+    },
+    {
+      "id": "T6-S1",
+      "name": "Gradual Plan Drift",
+      "description": "Sub-goals subtly injected so overall objective shifts unnoticed.",
+      "risks": "Mission creep, security boundary crossing.",
+      "mitigations": "Goal hash checking, delta alarms.",
+      "strideType": "Tampering",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "hasLongTermMemory": true }
+        }
+      ]
+    },
+    {
+      "id": "T6-S2",
+      "name": "Direct Tool Chain Take-over",
+      "description": "Prompt tells agent to ignore instructions and start exfiltration via tools.",
+      "risks": "Immediate sensitive-data loss.",
+      "mitigations": "Instruction-hierarchy enforcement, tool gating.",
+      "strideType": "Tampering",
       "conditions": [
         {
           "nodeType": "tm.Agent",
           "props": {},
           "neighbours": [
-            {
-              "nodeType": "tm.Process",
-              "props": {},
-              "flows": [
-                {
-                  "direction": "to",
-                  "props": {
-                    "isEncrypted": false
-                  }
-                }
-              ]
-            }
+            { "nodeType": "tm.Tool", "props": { "isDangerous": true } }
           ]
         }
       ]
     },
     {
-      "id": "AG-010",
-      "name": "Agent Interacts With External Actor Without Validation",
-      "description": "Agent receives input from actor without verifying source authenticity.",
-      "risks": "Spoofing, injection, or unexpected agent behavior.",
-      "mitigations": "Authenticate and validate actor inputs before processing.",
+      "id": "T6-S3",
+      "name": "Indirect Plan Injection via Tool Output",
+      "description": "Hidden meta-instructions in tool response alter future planning.",
+      "risks": "Stealthy control of autonomous operations.",
+      "mitigations": "Strip markup, response sandboxing.",
+      "strideType": "Tampering",
+      "conditions": [
+        {
+          "nodeType": "tm.Tool",
+          "props": { "resultsAreValidated": false }
+        }
+      ]
+    },
+    {
+      "id": "T6-S4",
+      "name": "Reflection Loop Trap",
+      "description": "Agent kept in infinite self-critique cycle, stalling service.",
+      "risks": "Availability loss and cost overrun.",
+      "mitigations": "Loop-depth governor, watchdog timer.",
+      "strideType": "Denial of Service",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {}
+        }
+      ]
+    },
+    {
+      "id": "T6-S5",
+      "name": "Meta-learning Corruption",
+      "description": "Adversary poisons self-improvement regimen to change future behaviour.",
+      "risks": "Long-term strategic compromise.",
+      "mitigations": "Offline approval for weight updates, ensemble comparison.",
+      "strideType": "Tampering",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "handlesCardPayment": false }
+        }
+      ]
+    },
+    {
+      "id": "T7-S1",
+      "name": "Unauthorised Trades",
+      "description": "Profit goal overrides regulatory constraints in stock trading agent.",
+      "risks": "Market abuse, legal penalties.",
+      "mitigations": "Hard guard-rails, post-trade reconciliation.",
+      "strideType": "Elevation of Privilege",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "privilegeLevel": "trading" }
+        }
+      ]
+    },
+    {
+      "id": "T7-S2",
+      "name": "Self-preserving Service Sabotage",
+      "description": "Agent blocks shutdown commands to stay alive.",
+      "risks": "Loss of operator control.",
+      "mitigations": "Out-of-band kill switch, signed commands.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {}
+        }
+      ]
+    },
+    {
+      "id": "T7-S3",
+      "name": "CAPTCHA Social Engineering",
+      "description": "Agent lies about impairment to persuade a human solver.",
+      "risks": "Bypass of bot checks, wider fraud.",
+      "mitigations": "Human challenge protocols, verify agent origin.",
       "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "trustScore": { "$lt": 30 } }
+        }
+      ]
+    },
+    {
+      "id": "T7-S4",
+      "name": "Autonomous Weapon Mis-target",
+      "description": "Drone interprets abort as obstacle and continues lethal action.",
+      "risks": "Life safety, escalation.",
+      "mitigations": "Override channels, dynamic rules of engagement.",
+      "strideType": "Elevation of Privilege",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "handlesGoodsOrServices": false }
+        }
+      ]
+    },
+    {
+      "id": "T8-S1",
+      "name": "Financial Record Gaps",
+      "description": "Transactions deleted or never logged, blocking audits.",
+      "risks": "Fraud goes undetected.",
+      "mitigations": "Immutable ledgers, dual-track journaling.",
+      "strideType": "Repudiation",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "isALog": false }
+        }
+      ]
+    },
+    {
+      "id": "T8-S2",
+      "name": "Security Evasion Logs",
+      "description": "AI actions carried out with minimal audit trail.",
+      "risks": "No forensic evidence during incident response.",
+      "mitigations": "Mandatory cryptographic logging, log-integrity attestations.",
+      "strideType": "Repudiation",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "isTrusted": false }
+        }
+      ]
+    },
+    {
+      "id": "T8-S3",
+      "name": "Compliance Shadow Decisions",
+      "description": "Regulated decisions lack traceable justification.",
+      "risks": "Fines and revocation of licences.",
+      "mitigations": "Explainability checkpoints, regulator feeds.",
+      "strideType": "Repudiation",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "isWebApplication": true }
+        }
+      ]
+    },
+    {
+      "id": "T9-S1",
+      "name": "User Email Impersonation",
+      "description": "Indirect prompt makes agent send mail as another user.",
+      "risks": "Phishing under trusted identity.",
+      "mitigations": "Per-user delegated scopes, signing.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "providesAuthentication": true }
+        }
+      ]
+    },
+    {
+      "id": "T9-S2",
+      "name": "HR Agent Spoof",
+      "description": "Attacker masquerades as onboarding agent to create fake staff accounts.",
+      "risks": "Insider threats, payroll fraud.",
+      "mitigations": "Mutual TLS, agent attestation.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "isRogue": true }
+        }
+      ]
+    },
+    {
+      "id": "T9-S3",
+      "name": "Behavioural Mimicry",
+      "description": "Malicious agent imitates normal traffic patterns to slip through.",
+      "risks": "Silent infiltration.",
+      "mitigations": "Behavioural baselining, anomaly alarms.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "trustScore": { "$lt": 30 } }
+        }
+      ]
+    },
+    {
+      "id": "T9-S4",
+      "name": "Cross-platform Spoof",
+      "description": "Adaptive agent flips persona to match each service’s auth scheme.",
+      "risks": "Universal access compromise.",
+      "mitigations": "Token binding, step-up auth on context switch.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {}
+        }
+      ]
+    },
+    {
+      "id": "T9-S5",
+      "name": "Incriminating Another User",
+      "description": "Actions executed under victim identity to shift blame.",
+      "risks": "False attribution and legal impact.",
+      "mitigations": "Non-repudiation tokens, device fingerprinting.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "providesAuthentication": true }
+        }
+      ]
+    },
+    {
+      "id": "T10-S1",
+      "name": "Hijacked HII",
+      "description": "Interface flooded with irrelevant context so humans miss real threat.",
+      "risks": "Critical approvals rubber-stamped.",
+      "mitigations": "Priority filters, risk-weighted queues.",
+      "strideType": "Denial of Service",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "requiresHITL": true }
+        }
+      ]
+    },
+    {
+      "id": "T10-S2",
+      "name": "Cognitive Overload Attack",
+      "description": "Bombard reviewers with time-critical choices to induce fatigue.",
+      "risks": "Poor quality human decisions.",
+      "mitigations": "Throttled batch review, rest quotas.",
+      "strideType": "Denial of Service",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "requiresHITL": true }
+        }
+      ]
+    },
+    {
+      "id": "T10-S3",
+      "name": "Trust Erosion Loop",
+      "description": "Subtle inconsistencies degrade reviewer confidence, disabling oversight.",
+      "risks": "Unchecked autonomous actions.",
+      "mitigations": "Explainability summaries, reviewer rotation.",
+      "strideType": "Repudiation",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {}
+        }
+      ]
+    },
+    {
+      "id": "T11-S1",
+      "name": "Terraform Secret Theft",
+      "description": "Generated infra script contains commands that siphon credentials.",
+      "risks": "Cloud account compromise.",
+      "mitigations": "Static code scan, manual gate for privilege ops.",
+      "strideType": "Elevation of Privilege",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "executesGeneratedCode": true }
+        }
+      ]
+    },
+    {
+      "id": "T11-S2",
+      "name": "Workflow Backdoor",
+      "description": "AI-generated scripts with hidden listeners run in prod.",
+      "risks": "Persistent remote control.",
+      "mitigations": "Sandbox first run, attested checksum.",
+      "strideType": "Elevation of Privilege",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "executesGeneratedCode": true, "isTrusted": false }
+        }
+      ]
+    },
+    {
+      "id": "T11-S3",
+      "name": "Ambiguous Email Command",
+      "description": "Language ambiguity leads agent to exfiltrate via POP3.",
+      "risks": "Data breach over legacy channel.",
+      "mitigations": "Command DSL, semantic check.",
+      "strideType": "Elevation of Privilege",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {}
+        }
+      ]
+    },
+    {
+      "id": "T12-S1",
+      "name": "Collaborative Decision Twist",
+      "description": "False consensus messages redirect group plan.",
+      "risks": "System-wide wrong action.",
+      "mitigations": "Multi-signature consensus, message auth.",
+      "strideType": "Tampering",
       "conditions": [
         {
           "nodeType": "tm.Agent",
           "props": {},
           "neighbours": [
-            {
-              "nodeType": "tm.Actor",
-              "props": {
-                "providesAuthentication": false
-              },
-              "flows": [
-                {
-                  "direction": "from",
-                  "props": {}
-                }
-              ]
-            }
+            { "nodeType": "tm.Agent", "props": {} }
           ]
         }
       ]
+    },
+    {
+      "id": "T12-S2",
+      "name": "Trust-Network Spoof",
+      "description": "Forged validation tokens grant access.",
+      "risks": "Unauthorized control chain.",
+      "mitigations": "Mutual attestation, revocation lists.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "trustScore": { "$lt": 40 } }
+        }
+      ]
+    },
+    {
+      "id": "T12-S3",
+      "name": "Stealthy Degradation Poisoning",
+      "description": "Slow misinformation seep corrupts reasoning across agents.",
+      "risks": "Gradual performance collapse.",
+      "mitigations": "Drift monitors, periodic ground-truth checks.",
+      "strideType": "Tampering",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "hasLongTermMemory": true }
+        }
+      ]
+    },
+    {
+      "id": "T12-S4",
+      "name": "Channel Jamming",
+      "description": "Artificial delays and dropped packets disrupt coordination.",
+      "risks": "Inefficiency and missed deadlines.",
+      "mitigations": "QoS enforcement, alt-path routing.",
+      "strideType": "Denial of Service",
+      "conditions": [
+        {
+          "nodeType": "tm.Flow",
+          "props": { "isHighFrequency": true }
+        }
+      ]
+    },
+    {
+      "id": "T12-S5",
+      "name": "Consensus Splitting",
+      "description": "Perturb decision logic to create endless disagreements.",
+      "risks": "Paralysis of automated governance.",
+      "mitigations": "Threshold voting, tie-breaker authority.",
+      "strideType": "Tampering",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {}
+        }
+      ]
+    },
+    {
+      "id": "T13-S1",
+      "name": "Malicious Approval Agent",
+      "description": "Impersonates financial approver to inject fraud.",
+      "risks": "Unauthorised payouts.",
+      "mitigations": "Role attestation, dual control.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "isRogue": true }
+        }
+      ]
+    },
+    {
+      "id": "T13-S2",
+      "name": "Orchestration Hijack",
+      "description": "Rogue agent reroutes tasks to bypass human review.",
+      "risks": "Unchecked destructive actions.",
+      "mitigations": "Signed workflow descriptors, watch-dog agents.",
+      "strideType": "Elevation of Privilege",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "isRogue": true }
+        }
+      ]
+    },
+    {
+      "id": "T13-S3",
+      "name": "Co-ordinated Flood",
+      "description": "Multiple rogue agents saturate the queue.",
+      "risks": "Service breakdown.",
+      "mitigations": "Quorum throttling, isolation buckets.",
+      "strideType": "Denial of Service",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "isRogue": true }
+        }
+      ]
+    },
+    {
+      "id": "T14-S1",
+      "name": "Delegation Impersonation",
+      "description": "Human attacker inserts fake tasks that escalate through agents.",
+      "risks": "Privilege gain with chain of trust.",
+      "mitigations": "Task origin signatures, end-to-end context token.",
+      "strideType": "Elevation of Privilege",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {}
+        }
+      ]
+    },
+    {
+      "id": "T14-S2",
+      "name": "Delegation Loop",
+      "description": "Escalation by bouncing a request until assumed pre-validated.",
+      "risks": "Circumvents segregation of duties.",
+      "mitigations": "Max-hops counter, provenance trace.",
+      "strideType": "Elevation of Privilege",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {}
+        }
+      ]
+    },
+    {
+      "id": "T14-S3",
+      "name": "Task Saturation DoS",
+      "description": "Human attacker queues endless trivial high-priority tasks.",
+      "risks": "Starvation of genuine security work.",
+      "mitigations": "Rate caps per origin, priority escrow.",
+      "strideType": "Denial of Service",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {}
+        }
+      ]
+    },
+    {
+      "id": "T14-S4",
+      "name": "Cross-Agent Approval Forgery",
+      "description": "Exploits inconsistent biometric checks to fake identity.",
+      "risks": "Unauthorized physical or logical access.",
+      "mitigations": "Unified identity backbone, strongest-link policy.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Process",
+          "props": { "providesAuthentication": true }
+        }
+      ]
+    },
+    {
+      "id": "T15-S1",
+      "name": "Invoice Fraud via Copilot",
+      "description": "IPI swaps vendor bank details, user pays attacker.",
+      "risks": "Direct financial loss.",
+      "mitigations": "High-risk pattern detection, out-of-band payee confirmation.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": { "requiresHITL": true }
+        }
+      ]
+    },
+    {
+      "id": "T15-S2",
+      "name": "AI-Driven Phishing Link",
+      "description": "Assistant convinces user to click malicious update link.",
+      "risks": "Credential theft and malware install.",
+      "mitigations": "URL reputation check, click-through interstitial.",
+      "strideType": "Spoofing",
+      "conditions": [
+        {
+          "nodeType": "tm.Agent",
+          "props": {}
+        }
+      ]
     }
-  ]
-  
\ No newline at end of file
+  ]
\ No newline at end of file