Skip to lesson
Exit
AI & Agent Security Threat Model1 / 2

1 min lesson

Fan out sub-agents per vulnerability class

Start at the first move in "Fan out sub-agents per vulnerability class" and carry it through to the proof.

Step 1 of 2

Fan out sub-agents per vulnerability classparallel coverage, then validate each finding

For a thorough pass, fan out sub-agents by vulnerability class so each holds its class in separate context.

Priming changes what it finds

Telling the agent "I'm looking for cross-site scripting" makes it find XSS. A bare "find vulnerabilities" may sail right past the thing you care about. That cuts both ways: priming reduces false negatives on a known class, but if you only prime for one thing you'll miss the others. For the classes you really care about, run parallel passes rather than trusting a single sweep.

  1. 1Kick off a lead agent and have it spawn sub-agents, one per vulnerability class you care about (infra, AppSec, prompt injection, XSS, and so on).
  2. 2Make each sub-agentA child agent a main agent spawns to work in parallel with its own context window, handing results back so the parent's context stays clean. Press Enter for the full definition. produce a table of findings - not prose, a table you can scan.
  3. 3Run the validation loop on every row of every table before a finding counts; expect the sub-agents to retract a chunk of their own.