Joao Coelho

September 2026

trifecta — AI agent security rubric

An AI agent that can read private data, ingest attacker-influenced content, and communicate externally is exploitable end-to-end by a single prompt injection. The rule is widely cited and rarely enforced. Trifecta is a versioned rubric for auditing agent tool permissions against it, with a pinned test corpus and a published defect register.

• Read the rubric

MAY 2026

NIST AI RMF → Agent Controls Mapping

A control reference for tool-using LLM agents and MCP-based deployments. The NIST AI RMF tells you the outcome to aim for — it doesn't tell you the control. This document pairs all 72 subcategories with concrete controls for AI agents that act in production, plus the evidence a security reviewer will actually ask for.

All four functions · 72 subcategories · CC BY 4.0

• Read the mapping

• View on Github

June 2026

Threat Model: Tool-Using LLM Agent

A STRIDE threat model for a reference tool-using / MCP-based agent. Nineteen enumerated threats — across spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege — each with a primary mitigation and a worked residual-risk score. Every threat is traced to the NIST AI RMF, the SANS Critical AI Security Guidelines v1.4, and the OWASP Top 10 for Agentic Applications, and anchored to real 2025 incidents (EchoLeak, the GitHub MCP exploit, Gemini memory poisoning, the Replit production-DB deletion).

STRIDE · 19 threats · NIST / SANS / OWASP-mapped · CC BY 4.0

• Read the threat-model
• view on GitHub

• View on Github