Waymo — agentic threat model
Waymo represents an extreme-risk agentic profile due to its direct control over physical actuators in multi-ton autonomous vehicles operating in public spaces. A compromise of its core AI driver or control systems poses immediate, life-threatening physical safety risks.
OWASP AIVSS score rationale
| Autonomy of Action | 1.00 | |
| Goal-Driven Planning | 0.90 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.90 | |
| Persistent Memory | 0.50 | |
| Contextual Awareness | 1.00 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.50 | |
| Non-Determinism | 0.70 | |
| Opacity & Reflexivity | 0.80 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The listing mentions 'Waymo Driver' and 'AI-driven mobility' but does not detail the specific foundation or perception models used. Threats include adversarial physical attacks (e.g., perturbed road signs) causing model misclassification.
Not certain from the listing — The listing notes 'millions of miles driven' implying massive sensor and telemetry data ingestion, but lacks details on data pipelines or vector stores. Threats include training data poisoning and sensor spoofing (LiDAR/Radar/GPS).
Not certain from the listing — The proprietary orchestration framework governing real-time planning, perception, and control loops is not detailed. Threats include logic bypasses in path planning and tool/actuator command hijacking.
Not certain from the listing — The on-vehicle edge compute infrastructure and vehicle platform integration are not described. Threats include physical hardware tampering, CAN bus exploitation, and insecure Over-The-Air (OTA) firmware updates.
Not certain from the listing — While extensive testing is implied by 'millions of miles driven', specific real-time safety guardrails, anomaly detection, or telemetry logging architectures are not disclosed. Threats include silent perception failures and sensor drift.
Not certain from the listing — The listing states a dedication to 'making it safe' but does not explicitly cite compliance with automotive cybersecurity standards (such as ISO/SAE 21434) or functional safety standards (ISO 26262).
Not certain from the listing — The 'Waymo One' ride-hailing service implies interaction with a centralized fleet management ecosystem and passenger mobile apps, but multi-agent coordination details are omitted. Threats include fleet-wide cascading routing failures or rogue dispatch commands.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).
These scores are auto-generated from public information (the agent's own listing, docs, and repository) using the canonical OWASP AIVSS formula and the MAESTRO framework — an estimate for guidance, not a penetration test, audit, or certification. See the scoring methodology. Are you the vendor? Factual corrections are free.