Loading post…
Red HatKatie Mulliken, Jon Weiser, Judy KellyAnnouncement
AI threat modeling shouldn't be a bottleneck, so we open sourced ours
Summary
The post announces the open-sourcing of agentic-threat-modeling, an AI-assisted threat-modeling module for Claude Code, Cursor, and Gemini CLI, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). The module ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint. It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet. The team open sourced it because the problem isn’t unique to them, and it’s available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.
Context
The post announces the open-sourcing of an AI-assisted threat-modeling module for coding agents, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and is available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.
Approach / What changed
The module, agentic-threat-modeling, is a Lola module that runs inside AI coding tools like Claude Code, Cursor, and Gemini CLI. It profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). It produces structured output tied to specific files and lines, and can be installed via uv and run with commands like /threat-model or /threat-model-quick.
Takeaways
The module profiles likely attackers and generates narrative attack scenarios grounded in actual code, checked against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more).
It ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint, rather than producing generic advice.
It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet, and it’s open source in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.
FAQ
How does agentic-threat-modeling work?
It profiles likely attackers, generates narrative attack scenarios grounded in your actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). It ties every finding to a specific file and line of code.
How do I install and run it?
Install it with 'uv tool install lola-ai', then run 'lola market add prodsec' and 'lola install agentic-threat-modeling -a cursor' (or claude-code, gemini-cli). Then run /threat-model for a guided session or /threat-model-quick for a fast autopilot scan.
Why did they open source it?
It's open source because the problem isn't unique to Red Hat. The team built it to solve their own queue bottleneck and hopes to help other engineering teams unblock their pipelines too.
Source and freshness
- Source
- developers.redhat.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.