---
title: "AI threat modeling shouldn't be a bottleneck, so we open sourced ours"
description: "The post announces the open-sourcing of agentic-threat-modeling, an AI-assisted threat-modeling module for Claude Code, Cursor, and Gemini CLI, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). The module ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint. It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet. The team open sourced it because the problem isn’t unique to them, and it’s available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola."
---

# AI threat modeling shouldn't be a bottleneck, so we open sourced ours

[Red Hat](https://yomu.fyi/company/red-hat) · Katie Mulliken, Jon Weiser, Judy Kelly · Sep 21, 2026

**Type:** Announcement

## Summary

The post announces the open-sourcing of agentic-threat-modeling, an AI-assisted threat-modeling module for Claude Code, Cursor, and Gemini CLI, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). The module ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint. It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet. The team open sourced it because the problem isn’t unique to them, and it’s available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.

## Context

The post announces the open-sourcing of an AI-assisted threat-modeling module for coding agents, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and is available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.

## Approach / What changed

The module, agentic-threat-modeling, is a Lola module that runs inside AI coding tools like Claude Code, Cursor, and Gemini CLI. It profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). It produces structured output tied to specific files and lines, and can be installed via uv and run with commands like /threat-model or /threat-model-quick.

## Takeaways

- The module profiles likely attackers and generates narrative attack scenarios grounded in actual code, checked against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more).
- It ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint, rather than producing generic advice.
- It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet, and it’s open source in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.

## FAQ

### How does agentic-threat-modeling work?

It profiles likely attackers, generates narrative attack scenarios grounded in your actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). It ties every finding to a specific file and line of code.

### How do I install and run it?

Install it with 'uv tool install lola-ai', then run 'lola market add prodsec' and 'lola install agentic-threat-modeling -a cursor' (or claude-code, gemini-cli). Then run /threat-model for a guided session or /threat-model-quick for a fast autopilot scan.

### Why did they open source it?

It's open source because the problem isn't unique to Red Hat. The team built it to solve their own queue bottleneck and hopes to help other engineering teams unblock their pipelines too.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [AI Security](https://yomu.fyi/topic/ai-security), [Lola](https://yomu.fyi/topic/lola), [Open Source](https://yomu.fyi/topic/open-source), [Threat Modeling](https://yomu.fyi/topic/threat-modeling)

- Source: [Red Hat](https://developers.redhat.com/articles/2026/09/21/ai-threat-modeling-shouldnt-be-a-bottleneck-so-we-open-sourced-ours)
- Source URL: https://developers.redhat.com/articles/2026/09/21/ai-threat-modeling-shouldnt-be-a-bottleneck-so-we-open-sourced-ours
- Ingested by Yomu: 2026-09-21T15:00:16.046Z

[Read original post](https://developers.redhat.com/articles/2026/09/21/ai-threat-modeling-shouldnt-be-a-bottleneck-so-we-open-sourced-ours)