More code is shipping faster than ever. AI is writing a growing share of it, and AI-powered scanners are finding more issues in it than any human team can review by hand. That problem existed before AI. Security teams have never scaled linearly with engineering headcount and AI code generation has dramatically accelerated that imbalance. The security team's review calendar is a queue that keeps growing, so we built a way for engineers to threat model their own code without waiting in that queue.
Agentic-threat-modeling is an open source AI-assisted threat-modeling module for Claude Code, Cursor, and Gemini CLI, and we've open sourced it for all to use.
Architecturally, this runs on Lola, an open source package manager for AI contexts. If you're not familiar, our team wrote a full introduction about it in the article Manage AI context with the Lola package manager. The short version: Write a skill once as a Lola module, and it installs and runs identically across Claude Code, Cursor, Gemini CLI, and whatever your team standardizes on next, no re-writing prompts per tool.
Introducing the agentic-threat-modeling Lola module
Point agentic-threat-modeling at a feature or service, and it profiles who's likely to attack it, and then writes out narrative attack scenarios grounded in your actual code, checked against 6 different and structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more).
This isn't the same as pasting a file into a chat window and asking "is this secure?"
Instead, this is grounded in your real code paths, and it runs multiple structured frameworks instead of one generic pass. Rather than producing a paragraph of general advice, it ties every finding to a specific file and line of code. Here's a trimmed real-world example, run against a file upload endpoint:
$ /threat-model-quick
Actor Profile: Opportunistic external attacker, no authentication
required to reach this endpoint.
Scenario (STRIDE: Tampering / Elevation of Privilege):
The upload handler accepts a user-supplied filename and writes
it directly to disk without sanitizing path separators. An
attacker uploads a file named "../../etc/cron.d/malicious" to
write outside the intended upload directory, achieving code
execution on the next cron tick.
Affected: src/handlers/upload.py:47
Suggested mitigation: Reject or normalize path separators in
filenames before use; write to a randomly generated filename and
store the original name as metadata instead.That's a full attacker profile and a specific, exploitable finding tied to an exact line of code, in under a minute, with no security team involvement. Run /threat-model instead of /threat-model-quick for a guided, interactive session that walks through your design decisions rather than autopiloting the scan.
Where this goes next
A Software Bill of Materials (SBOM) instantly tells you which components are affected when a new CVE is released. It can't tell you whether that vulnerable code path is actually reachable by an attacker, or already covered by a compensating control. That's the exact context a threat model captures, which is why we built ours to produce structured output rather than just a document a human reads once and files away.
It's a natural fit for AI-assisted triage down the line: Don't just answer "does this CVE exist?" but "Does it sit on a path we already flagged as attacker-reachable?" We haven't built that triage pipeline yet, but what we have built is the missing input for it.
Try it
Run the following command to install:
uv tool install lola-ai
lola market add prodsec https://raw.githubusercontent.com/RedHatProductSecurity/lola-market/main/general-market.yml
lola install agentic-threat-modeling -a cursor # or claude-code, gemini-cliThen run /threat-model for a guided session, or /threat-model-quick for a fast autopilot scan, as shown above.
Conclusion
None of this replaces human judgment. A threat model, AI-generated or not, is a starting point for a conversation and gives engineers an initial diagnostic to review, not an unquestionable verdict. However, it's a conversation every engineer can now start themselves, on their own code, in minutes, instead of waiting in a queue that only gets longer as AI writes more code and finds more vulnerabilities.
We built this to solve these issues for ourselves first. We've made it open source because the problem isn't unique to us, and we hope to help other engineering teams unblock their pipelines too.
Ready to unblock your workflow? Run the install commands above. Everything is open in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola. Try running a scan and let us know what you discover. Issues, feedback, and contributions are always welcome.
