TL;DR: To threat model AI applications, STRIDE-AI remaps Microsoft’s six categories onto ML assets, prompt pipelines, and agent tools. The catch is bigger than the remap. AI erased the one trust boundary STRIDE was built on. Instructions and attacker input share a single context window, so one injection can light up four categories at once. Here’s the walkthrough, and where ASTRIDE and MAESTRO take over.
Why STRIDE Breaks on AI Applications
STRIDE was built on a wall. Microsoft drew it up in the late 90s: six categories under one mnemonic, Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. You sketch a data flow diagram, march each component through the six questions, write down what breaks.
It works because old software is honest about who’s who. Same input, same output. Kernel mode over here, user mode over there. A hard line between the developer’s instructions and the user’s input.
That line is the wall. The whole method leans on it.
AI kicks the wall over. Same prompt, different answer across runs. And inside the model there’s no privilege line at all. Look at where everything actually lands:
context window:
[system prompt] <- trusted (the developer)
[tool descriptions] <- "trusted" (attacker writes these)
[retrieved docs] <- untrusted (RAG)
[user message] <- untrusted
[tool output] <- untrusted (attacker writes these too)
all of it -> one attention pass, no privilege bit anywhere
There’s the problem in a box. The model can’t tell an instruction from data, because nothing tags which is which. Call it the boundary that isn’t there. Every STRIDE category still applies, sure. They just all trace back to the same missing wall.
STRIDE-AI, the 2021 remap from Lara Mauri and Ernesto Damiani, was the first real swing at this. It did the one thing classic STRIDE never bothered with. It made the ML assets, the training data, the weights, the inference API, first-class citizens instead of afterthoughts.
The Six STRIDE Categories, Remapped for AI
So here’s the remap. One line of theory, one real hit each, so you can spot these in the wild instead of just reciting them:
Spoofing is a trojaned model wearing a clean face. You pull what looks like Llama off a community hub, the weights carry a backdoor that only fires on a trigger phrase, and it sails through evals because the payload sleeps until called. Multi-agent setups make it worse. One agent claims to be another, no crypto proof, and you trusted the claim.
Tampering is prompt injection and data poisoning, the same attack at two different clocks. Poison the training set and the backdoor ships baked in. Inject at inference and you rewrite the instructions live. This is why OWASP ranks prompt injection LLM01 two editions running. Developer instruction and attacker payload arrive as the same tokens through the same attention pass, and the model obeys both.
Repudiation is the agent that did the thing and left no trace of why. Most frameworks log the final output and nothing else. So when an agent wires money or nukes a file, can you rebuild the retrieved context, the tool-call chain, the system prompt that were live when it fired? Usually not.
Information Disclosure is your system prompt walking out the front door. Coax it out word for word. Invert the embeddings in your “encrypted” vector store back into plaintext. Or let the model render a markdown image whose URL smuggles the whole conversation into someone’s
access.log. We ran that last one live in MCP tool poisoning.Denial of Service is your cloud bill, weaponized. Nobody crashes anything. The attacker forces expensive execution paths, stays under every request-based rate limit, and quietly runs the meter. Stolen keys pointed at a hosted model have cost victims real six-figure money. Full teardown in denial of wallet.
Elevation of Privilege is excessive agency. The model holds the tools, the APIs, the filesystem. Trick it with an injection and you inherit every permission it was handed. This one sits underneath nearly every real agentic incident, which is exactly why it’s the one that hurts.
Six tidy boxes. Real attacks refuse to stay in them.
Where STRIDE-AI Runs Out on Agents
Point STRIDE-AI at an agent and the boxes start bleeding together. In classic STRIDE a threat lives in one category and you patch it there. Clean. One box, one fix.
An agent doesn’t play along. A single poisoned tool output isn’t one threat. It’s four, firing at once:
one poisoned tool-output, four STRIDE hits:
reads private context -> Information Disclosure
calls an over-scoped tool -> Elevation of Privilege
loops the reasoning -> Denial of Service (wallet + compute)
writes no decision log -> Repudiation
payload: [REDACTED] exfil: https://<attacker_domain>/?d=[ENCODED]
One input, four boxes lit. The framework wants you to file that under a category. It doesn’t have a category for “all of them.”
And the Denial of Service box stopped being about the bill. LLMjacking started life as cost theft, attackers renting out your stolen inference on the cheap. Then the same crews turned that hijacked compute into an engine. One documented framework runs on stolen model access and does its own recon and privilege escalation between stages, no human on the keyboard. Your model didn’t just cost you money. It became the attacker’s brain.
STRIDE never had a box for “my asset is now hostile infrastructure.” How do you file a Spoofing threat when the thing doing the spoofing is your own model, on your own dime?
That gap is the whole reason the newer frameworks exist.
The Frameworks Built to Fill the Gap
Two frameworks pick up where STRIDE-AI runs out, and they attack the gap from opposite ends.
ASTRIDE, out of a late-2025 paper, just bolts a seventh letter on. “A” for AI Agent-Specific Attacks. Prompt injection, unsafe tool invocation, reasoning subversion, all pulled into their own category instead of smeared across the old six. It keeps the STRIDE shape and gives the agent-native stuff a home of its own.
MAESTRO, from the Cloud Security Alliance, goes the other way. It slices the agent stack into seven layers, foundation model up through the agent ecosystem, and asks what breaks at each one. Where STRIDE asks what goes wrong at a component, MAESTRO asks what goes wrong at a layer. It extends STRIDE, it doesn’t fire it.
So which do you reach for? Depends on your blind spot. ASTRIDE if your DFDs are solid and you just need the agent threats named. MAESTRO if the failure is cross-layer, the kind that slips between components because no single box owns it.
Here’s the thing though. Under all of them still sits Shostack’s four questions. What are we building. What can go wrong. What are we doing about it. Did we do a good enough job. The frameworks are new. The four questions never went anywhere.
Up next: steps you can take right now and a field-ready security prompt. Thanks for rolling with ToxSec. Let’s get operational.
