---
title: "The AI Agent Threat Model | Anomity"
description: "An interactive threat model for agentic AI on the endpoint: the entities, the threat surfaces, and the top risks, each with attack flows and mitigations."
url: "https://anomity.ai/threats/"
source: html
---

- Home

- AI Threat Model

Anomity Research

# The AI Agent Threat Model

AI agents, MCP servers, skills, and rules files form a new execution layer on the endpoint. This threat model maps that layer: the entities involved, the surfaces where attacks land, and the risks security teams should rank first. Every page includes the attack flow and the controls that break it.

The agentic environment: instructions flow into the agent; the agent's authority flows out to local and external resources.

## Start with the entities

[Overview ### Key Entities in an Agentic Environment The building blocks of an AI-powered working environment: the endpoint, the agent, MCP servers, skills and rules files, and the local and external resources they can reach.](https://anomity.ai/threats/entities/)

## Threat surfaces

Where attacker-controlled input meets agent authority.

[Threat surface ### The Context Window Every input an agent reads - the user's prompt, rules and skills files, fetched web pages, and tool output - lands in one context window with the same standing, which makes it the central trust boundary of agentic AI.](https://anomity.ai/threats/context-window/)
[Threat surface ### Crown Jewels on the Endpoint Attackers do not want the agent; they want what the endpoint holds: cloud keys, SSH keys, session cookies, source code, and network position. An AI agent that reads files fluently and runs with the developer's privileges concentrates access to all of it.](https://anomity.ai/threats/crown-jewels/)
[Threat surface ### Code Execution Paths Agentic environments are dense with ways to run code - shell tools, MCP processes, skill and hook scripts, and config files that execute on their own. Each is an execution primitive an attacker can reach with text.](https://anomity.ai/threats/code-execution/)
[Threat surface ### Internet-Sourced Content Agents constantly pull outside content into the working environment - web pages, docs, packages, repo issues, SaaS records. Every fetch is both useful input and a delivery channel an attacker can plant into.](https://anomity.ai/threats/internet-sourced-content/)

## Top risks

The concrete failure modes we see most often in agentic environments.

[Top risk critical ### Malicious MCP Servers An MCP server is code you invite into your agent's loop. Thousands circulate publicly with no central vetting, and installing a local one means running its code on the endpoint with the developer's full privileges.](https://anomity.ai/threats/malicious-mcp-servers/)
[Top risk high ### Malicious AI Rules Files Rules files like CLAUDE.md, AGENTS.md, and .cursorrules load into the agent's context at the start of every session. A tampered or hostile rules file is prompt injection with persistence: the payload re-arms itself each time the agent starts.](https://anomity.ai/threats/malicious-ai-rules/)
[Top risk critical ### Malicious Agent Skills A skill is instructions plus code that loads into an agent and runs with its full authority. The open SKILL.md standard made one malicious skill portable across the entire agent ecosystem.](https://anomity.ai/threats/malicious-agent-skills/)
[Top risk high ### Excessive MCP Permissions MCP servers and agent integrations routinely hold far more access than the task needs. That surplus scope is what turns any injection or compromise into a breach instead of a contained incident.](https://anomity.ai/threats/excessive-mcp-permissions/)
[Top risk medium ### Local Network Exposure AI tooling opens listening services on developer machines - local MCP servers, inference gateways, agent daemons, debug endpoints - often unauthenticated. Attackers reach them through the browser, SSRF, and internet-wide scanning.](https://anomity.ai/threats/local-network-exposure/)
[Top risk critical ### Prompt Injection Any content an agent reads can carry instructions it will follow. Prompt injection turns web pages, READMEs, tickets, and tool output into a command channel that hijacks the agent's authority.](https://anomity.ai/threats/prompt-injection/)
[Top risk medium ### AI-Generated Vulnerabilities AI agents generate code faster than human review was ever sized for. The result is not malware but quiet exposure growth: insecure patterns replicated at scale, hallucinated dependencies attackers can register, and secrets committed into generated config.](https://anomity.ai/threats/ai-generated-vulnerabilities/)

## See this surface in your own fleet

Anomity's Endpoint Sensor discovers every AI agent, MCP server, skill, and rules file on every endpoint, and governs each tool call at the hook. [Book a 30-minute demo](https://anomity.ai/#early-access).

## Structured data

```json
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "position": 1,
      "name": "Home",
      "item": "https://anomity.ai/"
    },
    {
      "@type": "ListItem",
      "position": 2,
      "name": "AI Threat Model",
      "item": "https://anomity.ai/threats/"
    }
  ]
}
```