arXiv:2605.10763: MATRA framework models the attack surface of agentic AI systems via asset+attack-tree methodology

A team comprising Van hamme, Thomas Vissers, Javier Carnerero-Cano, Mario Fritz, Emil C. Lupu, Lieven Desmet, and Dinil Mon Divakaran published MATRA on arXiv on May 11, 2026 — a pragmatic threat-modeling framework addressing a practical gap in the security of agentic AI systems. The paper was accepted for the DeMeSSAI 2026 workshop held alongside the EuroS&P 2026 conference.

What practical problem does MATRA solve?

The authors point out that practitioners lack a systematic method for assessing how known LLM threats (prompt injection, data exfiltration, tool abuse) translate into concrete risks in deployed agentic systems. Existing literature offers abstract threat catalogs without connection to the architecture of a specific system. MATRA upgrades the diagnosis with structure: “a pragmatic threat modeling framework for agentic AI systems that adapts established risk assessment methodology.”

How does the two-step methodology work?

The first step is asset-based impact assessment — identifying what matters most to the organization: user credentials, financial transactions, internal documents, tool API keys. The second step is attack tree analysis — determining the likelihood of those outcomes within the system’s concrete architecture. The combination allows a practitioner to move from general threats to architecturally specific risks.

What did MATRA’s numbers show on OpenClaw?

The authors demonstrated MATRA on an OpenClaw deployment, a personal AI agent platform. The analysis quantified how two architectural controls — network sandboxing and least-privilege access — reduce overall risk by constraining the damage radius when an injection attack succeeds. Instead of a binary “attack possible” / “attack impossible” result, MATRA displays the degree of attack surface reduction depending on the combination of controls applied.

The paper’s contribution lies in translating LLM risks into the context of specific deployment architectures, enabling practitioners to evaluate which security controls genuinely reduce attack surface severity. The framework arrives at a moment when the enterprise market — NVIDIA OpenShell, AWS Bedrock Guardrails, Anthropic Computer Use sandbox — is building new isolation primitives specifically for agentic AI scenarios.