AgentReadyHomeAgent Listing

← Savery AI

Savery AI — agentic threat model

10.0AIVSS 10.0 · Critical

Savery AI presents a high-risk profile due to its autonomous multi-agent architecture, write-access integrations (GitHub, Google Cloud), and ability to modify codebases and run tests without explicit human-in-the-loop gates mentioned.

OWASP AIVSS score rationale

AIVSS = (CVSS_Base + AARS) × Mitigation_Factor, where AARS = (10 − CVSS_Base) × (Factor_Sum / 10) × ThM
CVSS base 9.8AARS uplift 0.16Factor sum 7.5/10Threat ×1.1Mitigation ×1.0
Autonomy of Action
0.90
Goal-Driven Planning
0.90
Self-Modification
0.40
Dynamic Tool Use
0.80
Persistent Memory
0.60
Contextual Awareness
0.80
Dynamic Identity
0.50
Multi-Agent Interactions
1.00
Non-Determinism
0.80
Opacity & Reflexivity
0.80

Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.

MAESTRO 7-layer threat model

Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.

L1 · Foundation Models⚠ not certain from listing

Not certain from the listing — uses unspecified foundation models for code generation and AI model training, leaving it vulnerable to adversarial prompt injection or model reprogramming that could result in malicious code generation.

L2 · Data Operations⚠ not certain from listing

Not certain from the listing — processes proprietary codebases, documentation, and training datasets, but vector store or RAG specifics are not detailed, posing potential risks of data exfiltration or codebase poisoning.

L3 · Agent Frameworks✓ mapped

Uses a multi-agent orchestration framework (PM, researcher, engineer, QA) to plan and execute code modifications, presenting risks of tool misuse and insecure integration with GitHub and GCP.

L4 · Deployment & Infrastructure⚠ not certain from listing

Not certain from the listing — requires execution environments to run unit tests and QA, but sandboxing, container isolation, or secrets management details for GCP/GitHub credentials are not specified.

L5 · Evaluation & Observability⚠ not certain from listing

Not certain from the listing — mentions embedded quality assurance before submission, but lacks details on security guardrails, logging, or drift monitoring to detect malicious or anomalous code modifications.

L6 · Security & Compliance (cross-cutting)⚠ not certain from listing

Not certain from the listing — targeted at enterprise IT but does not explicitly detail identity management, access controls, or compliance certifications (like SOC2) to govern autonomous code commits.

L7 · Agent Ecosystem✓ mapped

Employs a complex multi-agent network (PM, researcher, engineer, QA) operating in parallel, creating risks of cascading failures and trust abuse between synthetic personas during the development lifecycle.

MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).