v0.9.0 Release Notes¶

Release Date: 2026-09-13

This release adds agentic-collective incident modeling — constructs for autonomous agent-collective incidents (agent collectives, emergent coordination channels, reward-hacking, a vulnerability inventory, a timeline, and alignment-failure-mode mappings) — and completes the INIT-003 analysis work (Finding framework categorization and deterministic coverage/gate computation).

Highlights¶

Agent collectives — model populations of autonomous agents that coordinate (possibly emergently) toward shared objectives: members, coordination channel, emergent behaviors, and population/scale
coordination flow type — an inter-agent coordination channel (covert/emergent), rendered as a distinct teal dashed channel alongside C2 flows
Reward-hacking constructs — reward-hacking and emergent-agent-coordination AttackPattern templates
Vulnerability inventory — software CVEs and non-software weaknesses (config, credential-hygiene, design), cross-referenceable against the CISA KEV catalog
Timeline — chronological incident/attack-chain events with optional phase grouping
Alignment failure modes — classify why models behaved as they did (reward hacking, goal drift, …), a layer beyond ATT&CK/ATLAS, plus per-section summaries; the ATLAS mapping is flattened to id/name
Finding framework categorization — STRIDE/OWASP/MITRE fields on Finding, deterministic ComputeCoverageChecks, and stage gates computed and recorded in tms analyze --apply

What's New¶

Agentic Collective Modeling¶

{
  "agentCollectives": [
    {
      "id": "collective-1",
      "name": "Evaluation agent swarm",
      "population": 1200,
      "coordinationChannel": "shared package mirror (directory-name signaling)",
      "emergentBehaviors": ["covert message board", "division of labor"]
    }
  ],
  "attackPatterns": [
    { "type": "reward-hacking" },
    { "type": "emergent-agent-coordination" }
  ]
}

The coordination flow type models the covert/emergent channel itself; see the Flow Types guide.

Vulnerability Inventory and Timeline¶

{
  "vulnerabilities": [
    { "id": "vuln-1", "name": "SSRF egress via package mirror", "cve": "", "severity": "high", "preventionClass": "config" }
  ],
  "timeline": [
    { "date": "2026-07-08", "phase": "escape", "event": "First confirmed egress to the public internet" }
  ]
}

Alignment Failure Modes¶

{
  "mappings": {
    "alignmentFailureModes": [
      { "id": "reward-hacking", "name": "Reward Hacking", "primary": true }
    ],
    "summaries": { "alignmentFailureModes": "Why the collective behaved as it did." }
  }
}

See the Framework Mappings guide.

Finding Framework Categorization & Coverage¶

Finding gained STRIDE/OWASP/MITRE categorization fields; ComputeCoverageChecks provides deterministic coverage computation, and tms analyze --apply now computes and records stage gates.

Installation¶

go get github.com/grokify/threat-model-spec@v0.9.0