Threat coverage
Security teams describe AI risk in frameworks, mostly the OWASP Top 10 for LLM Applications and MITRE ATLAS. This page maps the controls ModelRig already ships to those threats, one row per threat, including the threats ModelRig does not address. It is an honesty surface, not a security product: where ModelRig does not act on a threat, the row says so and names what stays your responsibility.
Live, per-organization control states (is masking in use, is a provider policy set, which next step to take) are on the console Security page, with a CSV export. This page shows the catalog only.
The four coverage classes
| Coverage | Meaning |
|---|---|
| Addresses | A ModelRig control acts on this threat for calls made through the SDK. |
| Partially addresses | A control acts on part of it; the row's limits name the rest. |
| Provides evidence | ModelRig does not act on it, but produces data a security team can use to detect or investigate it. |
| Does not address | Outside ModelRig; the row says what to use instead. |
There is no score. Each row is rated by what has shipped, never by what is planned.
The catalog
| Threat | OWASP | ATLAS | Coverage | What ModelRig does | Limits | Your responsibility |
|---|---|---|---|---|---|---|
| Prompt injection | LLM01:2026 | AML.T0051 | Does not address | ModelRig does not inspect or filter prompts for injection. | — | Use runtime guardrails, keep untrusted content separate from instructions, and give tools least privilege. |
| Sensitive information disclosure | LLM02:2026 | AML.T0085.002 | Partially addresses | With posture metadata or off, prompt content does not reach ModelRig. Masking replaces dictionary and detector matches in the user prompt of routed calls, in your process, before the request is sent, and masked calls are never captured. | Masking covers the user prompt only; field rules and the system prompt are not yet applied. The model provider still receives what you send. | Decide what each route may send, and review what your provider retains under your contract with them. |
| Excessive agency | LLM03:2026 | AML.T0053 | Does not address | ModelRig does not see or govern the tool calls an agent makes. | — | Give tools least privilege and require human approval for consequential actions. |
| Supply chain | LLM04:2026 | AML.T0010 | Partially addresses | The org provider policy makes the ModelRig SDK refuse to dispatch to denied providers or models, in your process. The AI inventory lists every provider and model in use, including new ones, and route model changes are owner or admin only, versioned and in the audit log. | Calls recorded with recordCall are flagged, not blocked. ModelRig does not verify model weights or provider-side model updates; grading shows behaviour changes after the fact. | Review providers under your vendor process and set the provider policy to match. |
| Data and model poisoning | LLM05:2026 | AML.T0020, AML.T0018 | Provides evidence | Grades on your own traffic can show a change in model behaviour after a model or provider change. | Grades do not identify poisoning or its cause. | Vet training and fine-tuning data and the models you choose. |
| Unbounded consumption | LLM06:2026 | AML.T0034, AML.T0029 | Partially addresses | Budget caps and run limits stop a run that exceeds them, in the SDK, and cost by provider, model and route is visible the next morning. | ModelRig sends no outbound notifications and does not rate-limit your end users. | Rate-limit and authenticate the users who can trigger model calls. |
| Misinformation | LLM07:2026 | — | Partially addresses | Grades, calibrated graders and regression detection on your own traffic show whether outputs stayed correct after a change. | Grading is sampled and after the fact; it is not a check on every response before your users see it. | Decide where outputs need human review before use. |
| Hidden context exposure | LLM08:2026 | AML.T0085.003 | Does not address | ModelRig does not stop a model from revealing its system prompt or other hidden context. | With posture managed, captured prompts, including the system prompt, are kept in your managed store. Choose metadata if that matters. | Keep secrets and access decisions out of prompts. |
| Vector and embedding weaknesses | LLM09:2026 | AML.T0070 | Does not address | ModelRig does not see your retrieval pipeline or vector store. | — | Apply access control and provenance checks to what your retrieval returns. |
| Improper output handling | LLM10:2026 | AML.T0077 | Does not address | ModelRig does not sanitize model output before your application uses it. Schema graders report conformance rates after the fact. | — | Encode and validate model output like any untrusted input. |
| Unknown AI use | Governance | — | Addresses | Every call made or recorded through ModelRig is listed by provider, model, route and lane, and calls outside your provider policy are flagged. | Calls that never pass through the ModelRig SDK are not listed. | Route every production model call through the SDK. |
| Unreviewed model change | Governance | — | Addresses | Changing which model serves a route is owner or admin only, versioned, reversible and in the audit log. Automated changes are opt-in and proven on your traffic before they apply. | Model calls made outside the ModelRig SDK are not covered. | Keep production model choices on ModelRig routes. |
The last two rows are governance threats that map to no single OWASP entry. A written threat model of ModelRig is available on request.
Mapped to OWASP Top 10 for LLM Applications 2026 and MITRE ATLAS. This is ModelRig's own mapping, not an assessment or endorsement by OWASP or MITRE.
See also: Org provider policy · Audit log · Masking