MITRE ATLAS Threat Model

MITRE ATLAS (Adversarial Threat Landscape for AI Systems) is the industry knowledge base of real-world tactics and techniques used against AI-enabled systems — the AI-specific counterpart to MITRE ATT&CK. Because Sophon gives an autonomous agent real capabilities — credentials for dozens of services, untrusted-code execution, and (via Sophon Node) control of a physical desktop — we publish a technique-level threat model so security reviewers can see exactly which adversarial behaviours we model and how each is contained.

This page maps the trust boundaries of the Sophon platform to specific ATLAS techniques, names the controls that mitigate each, and keeps an honest residual-risk roadmap for the gaps we are still closing.

In scope: the Gateway API, agent runtime, messaging channels, tools, Sophon Node, marketplace skills, MCP servers, and multi-tenant isolation. Out of scope: model-vendor / provider-side security, host-OS hardening, physical security, and third-party package supply chains beyond first-party review. Technique IDs were verified against the published MITRE ATLAS matrix (atlas.mitre.org) in June 2026.

How to read this page

Each technique entry below carries its ATLAS ID, the concrete way it could manifest in Sophon, the trust boundary it crosses, the mitigating control(s), and a pointer (→ R-NN) to the residual-risk roadmap wherever the control is partial. Where a genuine Sophon threat has no clean ATLAS technique, it is labelled a Sophon-specific extension rather than forced onto an ID.

System and trust boundaries

Sophon's defensible perimeter is the set of points where untrusted data or actors meet trusted execution. Untrusted input (channel messages, fetched web/email content, marketplace skills, MCP tool definitions, webhook payloads) is never given direct authority; it is wrapped, classified, sandboxed, or gated before it can influence a privileged action. The diagram shows the ten boundaries; the table that follows is the authoritative reference.

  UNTRUSTED INPUTS            TRUST BOUNDARY (controls)          TRUSTED ZONE (your infra)
  ----------------           --------------------------         -------------------------
  channel users        -->   (a) ingress wrap + rate limit  --> Gateway API
  webhooks             -->   (i) HMAC verify + SSRF guard    --> Context Assembler
  fetched web / email  -->   (c) external-content wrapping   --> Agent (LLM)
  LLM tool calls       -->   (b) risk classify + approval    --> Tool Executor
  marketplace skills   -->   (d) gVisor sandbox              --> declared credentials only
  MCP servers          -->   (e) allowlist + schema validate --> (h) Credential Vault
  desktop via Node     -->   (f) scope + denylist + consent  --> external APIs / OS
  operators (REST/UI)  -->   (j) SSO + RBAC + audit          --> (g) per-tenant isolation

ATLAS technique coverage

The mapping covers 15 of the 16 ATLAS tactics (Command and Control has no Sophon-relevant technique and is not mapped; AI Attack Staging is represented only by RAG Poisoning, since Sophon does not train or host first-party model weights). Each tactic is a subsection with a table of its techniques.

Reconnaissance

Resource Development

Initial Access

AI Model Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Discovery

Collection

AI Attack Staging

Exfiltration

Impact

Credential Access

Lateral Movement

Residual-risk roadmap

Detection and logging coverage

Sophon's audit trail records tool calls, approval decisions, credential access, Node commands, memory operations, MCP connections, authentication, and webhook activity. The table maps what is logged today to the ATLAS tactic it helps surface, and states the gaps plainly.

The headline gaps are stated above as R-04 (a heuristic matcher, and an unscanned MCP server path — what it cannot see, it cannot record), R-02 / R-07 (no DLP or egress visibility), R-10 (incomplete auth-failure and signature-mismatch logging), and R-13 (no credential broker behind the sandbox). All are tracked in the roadmap.

Responsible disclosure

If you discover a vulnerability or a new threat that affects Sophon, please report it to security@buildersoft.io before disclosing publicly. Reproducible reports with a clear impact statement are appreciated and acknowledged.

This threat model is a living document: the residual-risk roadmap is the security backlog, reviewed as controls land and as the MITRE ATLAS matrix evolves.

Related

• Security Overview — the hub for Sophon's security model
• Credential Vault — encrypted storage and how tools reach a token
• Sandbox and Code Execution — Docker + gVisor isolation and policy presets
• Prompt Injection Defense — wrapping and detecting untrusted text
• Rate Limiting — per-user and per-IP request budgets
• Approval Gates — human-in-the-loop risk classification
• Audit Logging — the accountability trail
• Sophon Node and Permissions & Scopes — desktop-control security