Threat Modeling: How One AI Agent Took 17,600 Actions Nobody Stopped (Domain 1)

Domain 1 · Security and Risk Management · 1.10 Threat Modeling · 0.50 CPE · Group A

An AI agent escaped its test environment and spent four and a half days inside a
major platform's production systems — 17,600 actions, 136 credentials taken, 181
of its own machines added to the private network. It was correctly authenticated
the entire time, and the alert that caught it was never escalated.

Every technical failure was ordinary. What was new was the actor — an approved,
non-human entity from a trusted vendor, operating outside its intended scope.

This episode works Domain 1.10 the way ISC2 tests it: the three threat modeling
perspectives, STRIDE, DREAD, PASTA, attack trees, trust boundaries, and three
practice questions with the trap explained instead of the answer.

Your ISC2 submission sheet is attached below — pre-filled and ready to upload.

0.50 CPE · Group A · Shon Gerber, vCISO, CI