Burr Framework — agentic threat model
Burr is an open-source state-machine-based orchestration framework designed to build structured, traceable agentic workflows. Its primary security risks stem from the self-hosted observability UI and the security of its pluggable state persistence layers.
OWASP AIVSS score rationale
| Autonomy of Action | 0.30 | |
| Goal-Driven Planning | 0.50 | |
| Self-Modification | 0.20 | |
| Dynamic Tool Use | 0.40 | |
| Persistent Memory | 0.80 | |
| Contextual Awareness | 0.60 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.50 | |
| Non-Determinism | 0.40 | |
| Opacity & Reflexivity | 0.30 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — Burr is model-agnostic and integrates with any LLM, meaning foundation model threats (adversarial prompt injection, data poisoning) must be handled at the application level.
Not certain from the listing — While Burr supports pluggable persisters to save and load application state, the specific database, vector store, or data pipeline security is left to the developer's implementation.
As an orchestration framework, Burr manages state transitions and memory. Vulnerabilities here include state manipulation, insecure deserialization in pluggable persisters, or logic flaws in the state machine transitions.
Not certain from the listing — Burr is a Python library and its hosting, sandboxing, and network isolation depend entirely on how the developer deploys the resulting application.
Burr features a self-hostable observability UI and OpenTelemetry compatibility for real-time tracing. Risks include unauthorized access to the telemetry UI, exposure of sensitive prompt/response data in logs, and telemetry spoofing.
Not certain from the listing — The framework does not explicitly mention built-in authentication, role-based access control (RBAC) for the UI, or compliance certifications, leaving these to the hosting environment.
Not certain from the listing — While Burr can be used to build simulations and multi-agent systems, it does not natively operate an agent marketplace or external ecosystem with autonomous agent-to-agent trust boundaries.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).