Why AI Agents Need a Full Threat Model, Not Just Prompt Filtering

Unlike chatbots that only generate text, autonomous AI agents can execute code, call tools, move data, and trigger payments, making their security risks far more complex. Security firm Stellar Byte Capital outlines a threat model spanning three planes: the model layer, the action layer, and the runtime environment where the agent's code actually runs. The framework identifies eight key threat vectors, including prompt injection, tool misuse, data exfiltration, credential theft, and unbounded cost from runaway loops. Core defenses recommended include least-privilege tool access, isolating code execution in disposable containers, enforcing default-deny network egress, and requiring human approval before high-impact actions. The central argument is that prompt filtering alone addresses only the first plane, while most serious damage occurs at the action and runtime levels.