Doc Spot — agentic threat model
Doc Spot is a low-autonomy medical calculator agent whose primary risk lies in the high-consequence nature of medical decision-making, where LLM hallucinations or prompt injections could lead to incorrect dosage or clinical calculations.
OWASP AIVSS score rationale
| Autonomy of Action | 0.10 | |
| Goal-Driven Planning | 0.10 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.20 | |
| Persistent Memory | 0.00 | |
| Contextual Awareness | 0.20 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.30 | |
| Opacity & Reflexivity | 0.20 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — likely relies on a commercial or open-source foundation model to parse user queries into structured calculator inputs. Adversarial prompt injection could bypass safety alignment, causing the model to output incorrect formulas or hallucinated medical advice.
Not certain from the listing — likely utilizes a static database or simple RAG setup of medical formulas and specialty guidelines. Knowledge-base poisoning or incorrect formula mapping represents a critical threat to calculation integrity.
Not certain from the listing — likely uses basic tool-calling to execute mathematical functions. Insecure tool integration or parameter injection could allow users to pass malformed inputs that crash the calculator or return erroneous values.
Not certain from the listing — presumably hosted as a web application or API. Standard web infrastructure threats apply, including lack of input sanitization before passing data to calculation microservices.
Not certain from the listing — no observability or clinical validation guardrails are mentioned. The lack of strict output verification for mathematical accuracy in LLM-generated responses is a major blind spot.
Not certain from the listing — medical software typically requires strict compliance (e.g., HIPAA, FDA Software as a Medical Device guidelines). The listing does not indicate any formal certifications or access controls to verify user credentials.
Not certain from the listing — operates as a standalone utility with no apparent multi-agent coordination or ecosystem integration, minimizing horizontal cascading failure risks.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).