Formy 3d — agentic threat model
Formy 3D is a specialized generative AI platform for 3D model creation with low agentic risk, primarily presenting standard web application, intellectual property, and model-abuse vectors rather than autonomous execution threats.
OWASP AIVSS score rationale
| Autonomy of Action | 0.10 | |
| Goal-Driven Planning | 0.10 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.10 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.20 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.60 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — likely uses proprietary or open-source 3D generative models (e.g., diffusion or NeRF-based architectures). Threats include model stealing of proprietary weights and adversarial prompt injection to bypass generation safety limits.
Not certain from the listing — requires large datasets of 3D meshes, textures, and CAD files for training. Threats include training data poisoning (leading to corrupted or biased generations) and intellectual property/copyright infringement claims on training data.
Not certain from the listing — orchestration is likely a simple pipeline converting text/image inputs to 3D formats rather than a complex agentic framework. Threats include insecure handling of input parameters and generation pipeline bypasses.
Not certain from the listing — requires heavy GPU infrastructure for 3D generation and rendering. Threats include resource exhaustion (DoS) due to expensive rendering tasks and potential container escape if user-uploaded assets are processed unsafely.
Not certain from the listing — likely relies on basic user feedback or automated mesh validation. Threats include lack of automated safety filters for inappropriate, offensive, or malicious 3D model generation.
Not certain from the listing — closed-source freemium platform with no explicit security certifications (like SOC2) mentioned. Threats include unauthorized access to user-generated intellectual property and lack of clear data privacy controls.
Not certain from the listing — operates as a standalone platform with no explicit multi-agent or marketplace integrations mentioned. Threats are minimal here, but could involve downstream supply chain risks if integrated into game engines.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).