CrewAI — agentic threat model
CrewAI is a highly collaborative multi-agent framework whose primary risk lies in agent-to-agent trust abuse, cascading failures, and insecure tool execution across delegated tasks. Because it lacks built-in sandboxing or compliance controls in its basic description, security relies entirely on the deployer's implementation.
OWASP AIVSS score rationale
| Autonomy of Action | 0.80 | |
| Goal-Driven Planning | 0.90 | |
| Self-Modification | 0.30 | |
| Dynamic Tool Use | 0.80 | |
| Persistent Memory | 0.50 | |
| Contextual Awareness | 0.70 | |
| Dynamic Identity | 0.30 | |
| Multi-Agent Interactions | 1.00 | |
| Non-Determinism | 0.80 | |
| Opacity & Reflexivity | 0.70 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — CrewAI is an orchestration framework that relies on external foundation models (like OpenAI, Anthropic, or local LLMs) which are not specified in the listing, making L1 threats dependent on the user's chosen model deployment.
Not certain from the listing — CrewAI manages task inputs and outputs but does not explicitly define its own vector stores or data ingestion pipelines in this directory listing, leaving data poisoning and lineage risks dependent on custom implementations.
As an orchestration framework, CrewAI is highly susceptible to L3 threats such as insecure tool integration, prompt injection leading to unauthorized tool execution, and memory poisoning across agent tasks.
Not certain from the listing — CrewAI is an open-source framework typically self-hosted or run locally, meaning infrastructure security, sandboxing of tool execution, and secrets management are entirely up to the deployer.
Not certain from the listing — The description does not mention built-in evaluation, logging, or guardrail mechanisms, which could lead to blind spots in monitoring agent-to-agent interactions.
Not certain from the listing — No compliance certifications (like SOC2) or built-in identity/authorization policies are mentioned, leaving access control to be implemented externally.
CrewAI's core value is multi-agent collaboration, making it highly vulnerable to L7 threats like cascading failures, agent-to-agent trust abuse, and rogue agents propagating malicious instructions across the 'crew'.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).