Category: AI

Background

Many AI threat modeling methods already exist, but two systematic gaps keep showing up. First, most of them were designed purely for LLMs, while the greatest risk today lies in Agentic AI, not in the language model alone: autonomous action, tool access, persistent memory, and self-modification. Second, the one framework that genuinely fits Agentic AI Agents well, MAESTRO, is too complex and demands deep technical expertise to apply.

This is an unnecessary barrier. As AI agents become mainstream, the discipline of threat modeling them needs to be simplified so that people without a specialized security background can model agent risk on their own. AGENTIC was built to close that gap.

Purpose

• Simple: applicable without a lengthy onboarding process.
• Intuitive: questions phrased so they are understandable without prior AI Security knowledge.
• Built for Agentic AI: unlike frameworks designed for LLMs, it addresses the specifics of agent autonomy and action.
• A complement, not a replacement: AGENTIC is meant as an entry point, after which teams can move to deeper, more technical frameworks when needed (see the comparison below).

Target audience

AGENTIC lowers the barrier to modeling threats for Agentic AI – the highest-risk category of AI use – so the method is accessible not only to AI security specialists, but also to:

• Security professionals who need to assess agentic solutions without deep prior expertise in AI security.
• Developers/engineers building an agent who need a fast pre-production sanity check.
• “Security champions” on product teams – technical people who are not security specialists but act as the first line of risk assessment.
• Anyone responsible for deploying AI agents who needs a shared, non-technical language to discuss “what could go wrong” with a technical team.

The seven elements

AGENTIC structures the analysis around seven elements, each anchored by a single guiding question that keeps the discussion intuitive and non-technical.

Applying the model

The modeling process follows four steps:

• Work through each of the seven elements in order (A → G → E → N → T → I → C), answering first the main diagnostic question, then the deeper follow-up questions. This order limits the risk of missing dependencies, since each element partly builds on the answers from the previous ones.
• Write every answer down; together they form a model of the entire agentic system.
• For each element, once all questions are answered, identify the single weakest point: a missing mechanism, unclear ownership, which becomes a candidate for high risk.
• While analyzing each subsequent element, actively question it against the risks already surfaced in earlier ones.

What AGENTIC does not cover

AGENTIC is deliberately scoped to agent-level architecture and behavior, so several adjacent problem areas are intentionally left to other frameworks and processes: 

• Model- and training-level threats – attacks on the training process, weight extraction, membership inference, adversarial examples at the network-architecture level. This is the domain of frameworks such as MITRE ATLAS in its full scope, not AGENTIC.
• Deep analysis of a single prompt or interaction – AGENTIC operates at the level of agent architecture and configuration, not individual dialogue turns. OWASP LLM Top 10, applied directly at the LLM layer, is better suited for that.
• Regulatory compliance – AGENTIC is not designed as a compliance checklist for the EU AI Act, ISO/IEC 42001, or similar regulations; compliance requirements define their own set of demands on an AI agent.

Elimination of subjectivity – like any qualitative model, AGENTIC’s results depend on the knowledge and experience of the person modeling. AGENTIC does not remove that subjectivity, only structures it.

Comparison with other frameworks

AGENTIC was not built in a vacuum. It is designed to combine well with existing frameworks rather than compete with them.

Summary

AGENTIC gives teams a fast, language-accessible way to reason about where an AI agent’s real risk lives and a clear path to deeper frameworks once a system’s risk profile calls for it.

The book Adversarial AI Attacks is unusual.

On the one hand, it can genuinely put you off while reading it, and yet I kept wanting to come back to it. It’s not Stockholm syndrome, but rather the real value it carries. But let’s get to the point.

At the beginning, we are met with an introduction, and it is quite strange. On the one hand, it introduces the topic of AI, but it does so in a very condensed, slogan-like manner. It feels as if it was written exclusively for people who are already very familiar with these concepts. At times, it resembles a conversation with a friend who wants to show off how many complex terms they know.

Another distinctive feature of the book appears here as well: the translation of technical terms into Polish. Initially, this is handled quite reasonably. Polish equivalents are provided alongside the original English terms. However, later in the book, only the Polish names are used, which makes reading more difficult, as it requires constantly recalling their English origins.

It is clear that the book was written by a highly technical person. It is not an easy read, yet despite that, I still felt compelled to return to it.

There are very few books on the market that focus on more sophisticated attacks on AI. Most publications stop at simpler threats, such as Prompt Injection or Unbounded Consumption. And that’s no surprise—it’s easy to compare them to classic attacks like SQL Injection or DoS. This book goes a step further and concentrates on lesser-known, more difficult attacks that often require specialized tools and/or knowledge of advanced mathematics. In this area, it offers an enormous amount of knowledge.

The structure is fairly systematic—each attack includes a description, its variants, industry examples, and methods for independent replication. Each one is also accompanied by a reference to the original academic research.

For this reason, I treat this book as a kind of lexicon of AI attacks, built on academic research. It is an excellent reference point—both for learning and for revisiting later when an opportunity arises to apply the described techniques (of course in testing, not in offensive use 😉). That is precisely why I see its schematic nature as an advantage.

The same applies to the source code—on a first reading, it can be skipped, but during deeper study, it becomes very useful. The downside is that sometimes the sample code is difficult to analyze without the full version available on GitHub. Fortunately, that option exists, so the book excerpts can be treated as commentary on the repository. Unfortunately, the grayscale illustrations instead of color ones are less readable and make understanding more difficult.

In summary: “Adversarial AI Attacks” is a highly valuable book, though written in a demanding way. It requires considerable effort and has a high entry threshold—definitely intended for readers who already have solid knowledge of AI. In return, however, it delivers an enormous amount of insight. It is hard to find another book in this field so densely packed with substantive material.

This book fits perfectly into the field of AI Security, which I work with on a daily basis. That’s why I had my eye on it for quite some time. I had heard mostly positive opinions about it. In my view, there still aren’t many titles on the market that cover this topic in a structured, example-based, and in-depth way. The subject is the book named The Developer’s Playbook for Large Language Model Security – review is just below.

For a long time, I had been planning to order the original version. But when I noticed that a Polish edition had been released, I decided to give it a shot and see if the positive reviews held true.

So, what is the book about? The Developer’s Playbook for Large Language Model Security is an ambitious attempt to systematize the risks, threats, and protection techniques for systems based on large language models (LLMs). The author takes on a tough challenge — describing a fast-evolving and still relatively new domain — in a methodical way, rich with examples and practical references.

One of the book’s strongest aspects is the abundance of vivid examples that help explain attack mechanisms and possible countermeasures. The style is reminiscent of Adam Shostack’s iconic book on threat modeling — both authors dissect their topic thoroughly, illustrating each threat class with specific, concrete cases. This is definitely a major strength of the book.

The book doesn’t try to be “cool” — but it’s solid. It reads more like a well-crafted textbook than a popular science title. However, thanks to its clear and practical examples, it doesn’t feel tedious. Reading it feels like reviewing a teammate’s notes — the kind who sketches the entire threat landscape on a whiteboard, then adds two real-world examples and a counterexample so you fully understand where something doesn’t apply.

I rate the book very positively. The subsequent chapters turned out to be highly educational and inspiring. I found myself jotting down new techniques every few pages — ideas I could immediately apply in my daily work.

Is this book for everyone?

No. And that’s a good thing. It’s a book for people who know that “prompt injection” is just the beginning of the problem list, not the end. It’s for those who want to learn to think about LLM systems as real, complex applications with vulnerabilities, attacks, and deployment context.

Would I recommend it?

Absolutely.

This book does an excellent job of organizing the current knowledge on AI security, particularly when it comes to integrating LLMs with broader IT systems.

The book The Developer’s Playbook for Large Language Model Security – review is very positive. I wish we have more books like this in AI Security area.