AI Attack Surfaces & Threat Modeling

When: Weeks 1--2, then revisit when RAG and agents are introduced.

• Map user input, system/developer instructions, conversation history, retrieved documents, model output, tool calls, external APIs, databases, logs, and human approvals.

• Learn the OWASP Top 10 for LLM applications as a threat taxonomy; check the current edition because categories evolve.

• Use STRIDE to prompt questions about spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

• Understand the confused deputy: a component with legitimate authority is tricked into using it for a caller who should not have it.

• Threat-model assets, identities, trust boundaries, entry points, data flows, threats, controls, tests, and residual risk.

Practice: threat-model the email-to-CRM agent from the supplied outline using mock email and a local/mock CRM. Identify indirect injection in email bodies/attachments, unauthorized CRM reads/writes, token exposure, data exfiltration, approval bypass, and audit gaps.

Do not learn yet: heavyweight enterprise threat-modeling bureaucracy. One accurate, testable threat model is more useful than a diagram nobody updates.