MAESTRO: threat-modeling AI agents in seven layers

If you've shipped an AI agent, you've probably hit the moment where someone asks "so what could go wrong?" and the honest answer is a shrug. Agents don't fail like a CRUD app. They have a model that can be steered, tools they can call, memory they accumulate, and an environment they act on — and the failure can start in one place and surface in another. MAESTRO is one attempt to make that question answerable in a structured way.

What MAESTRO is

MAESTRO — "Multi-Agent Environment, Security, Threat, Risk, and Outcome" — is a threat-modeling framework for agentic AI published by the Cloud Security Alliance (CSA), authored by Ken Huang of CSA's AI Safety work. It's a method, not a control catalog: it gives you a way to walk an agent system and enumerate what an attacker (or an accident) could do, layer by layer. It builds on familiar threat-modeling traditions — STRIDE, PASTA, LINDDUN and others — and adds the AI-specific concerns those older methods never had to consider, like adversarial inputs to a model or an agent acting autonomously in ways nobody scripted.

The reason a layered approach fits agents is that an agent isn't one thing. A prompt injection lives at the model boundary, a poisoned document lives in data, an over-permissioned tool lives in the framework, and a leaked credential lives in deployment. If you only threat-model "the agent" as a black box, you miss the seams between these pieces — and the seams are where agent attacks actually live.

The seven layers, in plain language

MAESTRO decomposes an agentic system into seven layers. Six are stacked; one (security and compliance) cuts across all of them.

1. Foundation Models — the underlying LLM or model the agent reasons with. Threats here include prompt injection, jailbreaks, and model-level data leakage.
2. Data Operations — ingestion, transformation, storage, retrieval. This is where poisoned training or RAG data, and tampering with what the agent "knows," lands.
3. Agent Frameworks — the libraries and abstractions that let the agent plan, call tools, and act. Over-broad tool permissions and unsafe orchestration logic show up here.
4. Deployment and Infrastructure — where the agent runs: sandboxes, hosts, networks, secrets. Classic infra exposure, but now with an autonomous process making the calls.
5. Evaluation and Observability — how you watch, log, and judge the agent's behavior. Gaps here mean you can't tell a good run from a compromised one.
6. Security and Compliance — the cross-cutting layer: access control, governance, policy. It touches every other layer rather than sitting in the stack.
7. Agent Ecosystem — the real-world surface: users, other agents, marketplaces, the domain the agent operates in. Multi-agent trust and abuse of the agent's standing in the world live here.

For each layer you ask the usual threat-modeling questions, but scoped to that layer's concerns, and then you pay special attention to threats that cross layers — an injection at Layer 1 that drives a tool call at Layer 3 that exfiltrates data through Layer 4. CSA has also published a companion Agentic AI Red Teaming Guide that uses this same decomposition to structure hands-on testing.

Practitioner takeaway

MAESTRO is most useful as the discovery half of your security work. Sit down with your agent's architecture, walk the seven layers, and write down what can go wrong in each — including the cross-layer chains, which are the ones generic checklists miss. The layered structure gives you a way to be systematic instead of relying on whoever in the room happens to remember prompt injection.

What it deliberately does not do is tell you how to fix things. MAESTRO surfaces threats; it doesn't hand you a normative set of controls, and it isn't trying to. So pair it with something that does. Run MAESTRO to build the threat list, then map each threat to a concrete control from a controls framework — input handling, tool-permission scoping, sandboxing, logging, human-in-the-loop gates. The threat model tells you what to worry about; the control framework tells you what to put in the code. Used that way, MAESTRO turns "what could go wrong?" from a shrug into a list you can actually work through.

---

MAESTRO is one of the sources behind *BRACE*, an open, vendor-neutral framework for securing autonomous AI agents — where MAESTRO helps you find what can go wrong layer by layer, BRACE names the controls to fix it. It's built by reading the incidents and the research and asking, each time: what concrete control would have prevented or contained this?