MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
LLMs are increasingly deployed as autonomous agents with access to tools, databases, and external services, yet practitioners (across different sectors) lack systematic methods to assess how known threat classes translate into concrete risks within a specific agentic deployment. We present MATRA, a pragmatic threat modeling framework for agentic AI systems that adapts established risk assessment methodology to systematically assess how known LLM threats translate into deployment-specific risks. MATRA begins with an asset-based impact assessment and utilizes attack trees to determine the likelihood of these impacts occurring within the system architecture. We demonstrate MATRA on a personal AI agent deployment using OpenClaw, quantifying how architectural controls such as network sandboxing and least-privilege access reduce risk by limiting the blast radius of successful injections.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 11 of its 36 references that are in the map. First posted on arXiv 11 May 2026.
Builds on
11 of 36 references.
Closest ancestors · 3
Same direction, newest first
- 2025LlamaFirewall: An open source guardrail system for building secure AI agents6 May
- 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
- 2025Defeating Prompt Injections by Design24 Mar
Other references · 8
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
- 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 129
- 2024Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?cited by 81
- 2024Get my drift? Catching LLM Task Drift with Activation Deltascited by 72
- 2024garak: A Framework for Security Probing Large Language Modelscited by 49
- 2025May I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attackscited by 15
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats
- 2026Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw
- 2026Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study
- 2026A Security Analysis of the OpenClaw AI Agent Framework
- 2026Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges
- 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges
- 2025A Safety and Security Framework for Real-World Agentic Systems
- 2026A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework