DeepSeek R1 — agentic threat model
DeepSeek R1 is a highly capable open-source reasoning foundation model with minimal native agentic autonomy, meaning its primary security risks stem from downstream integration, model alignment, and adversarial exploitation rather than direct autonomous actions.
OWASP AIVSS score rationale
| Autonomy of Action | 0.10 | |
| Goal-Driven Planning | 0.60 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.10 | |
| Persistent Memory | 0.00 | |
| Contextual Awareness | 0.50 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.70 | |
| Opacity & Reflexivity | 0.80 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
DeepSeek R1 is a massive 671B MoE foundation model. Key threats include adversarial jailbreaks, prompt injection, model reprogramming, and downstream fine-tuning alignment drift.
Not certain from the listing — training data pipelines, filtering processes, and RAG/vector store integrations are not specified, leaving potential gaps in data lineage and poisoning risks.
Not certain from the listing — DeepSeek R1 is a raw foundation model and does not natively include an agentic framework, tool execution, or memory management.
Not certain from the listing — deployment infrastructure (hosting, sandboxing, secrets) is managed entirely by the end-user or developer integrating the model.
Not certain from the listing — no built-in guardrails, logging, or drift detection mechanisms are detailed in the model's public directory listing.
Not certain from the listing — compliance alignments (like NIST, ISO, or EU AI Act) and access controls are not specified for this open-source model.
Not certain from the listing — multi-agent interactions or marketplace integrations are not natively supported or described.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).