Threat Modeling | Techlist.io

awsJun 17, 20263 min readCurated summary

AWS Security Agent adds threat modeling, Kiro power and Claude Code plugin, and more | Amazon Web Services

AWS Security Agent, now part of AWS Continuum, is expanding into a unified security platform spanning design, development, and deployment. New capabilities include threat modeling, deeper pull-request and repository reviews, compliance validation, and integrations with Kiro, Claude Code, and other AI IDEs through MCP. AWS’s central promise is to find vulnerabilities, verify exploitability, and provide actionable fixes without interrupting developers’ workflows. ## Enhanced Code Reviews - Supports GitHub, GitLab, and Bitbucket, including SaaS and self-hosted installations. - Integrates with Confluence so reviews can use existing technical and security documentation as context. - Performs reasoning-based analysis of pull requests and entire repositories, identifying vulnerabilities beyond pattern matching. - Checks code against organizational security requirements and common security risks. - Validates findings in simulated environments to demonstrate proof of exploitability. - Provides remediation guidance and fix commits directly in the repository workflow. - Supports pull-request scanning, remediation, security requirement packs, and simulated validation. ## Compliance and Design Reviews - Managed compliance packs include: - AWS WAF - NIST CSF - PCI DSS - AWS best practices - Organizations can import their own security requirements from internal documents or Confluence. - Findings are mapped to the organization’s compliance posture, helping teams maintain audit readiness throughout development. ## Threat Modeling - Generates threat models from design documents or source-code repositories. - Builds an application context model covering: - Architecture - Data flows - Trust boundaries - Application components - Identifies likely threat actors, attack vectors, and weaknesses. - Uses the STRIDE framework to classify threats. - Prioritizes risks and recommends mitigations. - Threat models can be generated from the Security Agent console or through supported development tools. ## Kiro, Claude Code, and MCP Integrations - A Kiro power is available, with a Claude Code plugin coming soon. - An open MCP integration enables use from Kiro, Claude Code, or other AI-powered IDEs. - Developers can trigger scans, threat models, and remediation directly from their IDE or CLI. - Kiro commands include: - `Set up AWS Security Agent` - `Run a full security scan on this repo` - `help me remediate my findings` - `Build a threat model for this application` - Findings can be downloaded into the local workspace, prioritized, and used to start bug-fix specification sessions. - Generated threat models are saved at `.security-agent/threat_model.md`. - A Kiro agent hook can automatically evaluate whether a code-review scan should run after an agent turn. ## Lifecycle Coverage and Availability - Design-time security: design reviews and threat modeling, both in preview. - Development-time security: repository and pull-request code reviews, in preview. - Deployment-time security: on-demand penetration testing, generally available. - The features are available in supported AWS commercial Regions, with regional availability and pricing listed in AWS documentation. AWS Security Agent is positioned as a continuous security layer across the software lifecycle. Teams interested in automated, context-aware security analysis can try it through the Security Agent console, while developers can use the IDE and MCP integrations to keep scanning and remediation within their existing workflows.

Read original

Threat Modeling Model Context Protocol Code Review Claude Code+3

dropboxJun 12, 20263 min readCurated summary

How Dropbox uses MCP and Dash to close the design-to-code security gap

Dropbox found a significant gap between security design reviews and implementation. Only 12% of implementing pull requests linked back to their original threat models, and the median delay between review and code submission was about five weeks. To close this gap, Dropbox built a system using Dash, Model Context Protocol (MCP), and foundational models to automatically retrieve relevant security requirements and compare them with code during review. ## The Design-to-Code Gap - Threat models document risks, attack scenarios, and agreed-upon mitigations during security review. - These documents often remain in wikis or documentation systems, while implementation happens later through pull requests. - At Dropbox: - Only 12% of implementing PRs linked to their original design review. - Among 79 verified pairs, 54% of PRs were opened more than a month after the review. - The median delay was approximately five weeks, with some delays exceeding 11 months. - Only 29% of PRs were opened within two weeks of the security review. - About 15% of design reviews were filed retroactively, suggesting that some security-sensitive work was not identified early enough. ## Why Existing Tools Fall Short - Static analysis can detect whether certain security patterns or controls exist. - It generally cannot determine whether those controls satisfy the specific requirements agreed upon during design review. - Manual linking between PRs and threat models depends on engineers remembering additional workflow steps. - Reminder bots may improve compliance temporarily, but adherence tends to decline. - The core problem is not a lack of security documentation; it is the difficulty of making that existing context available during implementation. ## Dash and MCP as a Context Bridge - Dash already indexes Dropbox content and connected applications, including threat models and engineering documentation. - Dropbox used Dash’s MCP server to let an AI security agent search and read this content. - MCP provides a common interface for bringing multiple context sources into one agent session. - When a PR is opened, the agent retrieves relevant threat models and supporting documents. - A foundational model then compares the documented requirements with the proposed code. - For example, it can identify whether code implementing an endpoint enforces authentication required by the corresponding threat model. - Unlike traditional static analysis, this approach evaluates code against documented security intent, not just known code patterns. ## Integrating Security into Code Review - Dropbox surfaced the system directly within the existing code-review workflow rather than creating a separate security process. - This allows developers and reviewers to receive relevant security context where implementation decisions are already evaluated. - The same mechanism can potentially identify missing reviews when code appears security-sensitive but has no corresponding threat model. Dropbox’s approach shows how retrieval and AI reasoning can reconnect design decisions with implementation. Organizations can apply the same pattern beyond security—for example, to compliance requirements, privacy reviews, accessibility standards, or other design-to-code checks.

Read original

Threat Modeling Large Language Models Model Context Protocol Code Review+2

lineNov 4, 2025Original article

Security Threat Cases and Countermeasures (opens in new tab)

Developing AI products introduces unique security vulnerabilities that extend beyond traditional software risks, ranging from package hallucinations to sophisticated indirect prompt injections. To mitigate these threats, organizations must move away from trusting LLM-generated content and instead implement rigorous validation, automated threat modeling, and input/output guardrails. The following summary details the specific risks and mitigation strategies identified by LY Corporation’s security engineering team. ## Slopsquatting and Package Hallucinations - AI models frequently hallucinate non-existent library or package names when providing coding instructions (e.g., suggesting `huggingface-cli` instead of the correct `huggingface_hub[cli]`). - Attackers exploit this by registering these hallucinated names on public registries to distribute malware to unsuspecting developers. - Mitigation requires developers to manually verify all AI-suggested commands and dependencies before execution in any environment. ## Prompt Injection and Arbitrary Code Execution - As seen in CVE-2024-5565 (Vanna AI), attackers can inject malicious instructions into prompts to force the application to execute arbitrary code. - This vulnerability arises when developers grant LLMs the autonomy to generate and run logic within the application context without sufficient isolation. - Mitigation involves treating LLM outputs as untrusted data, sanitizing user inputs, and strictly limiting the LLM's ability to execute system-level commands. ## Indirect Prompt Injection in Integrated AI - AI assistants integrated into office environments (like Gemini for Workspace) are susceptible to indirect prompt injections hidden within emails or documents. - A malicious email can contain "system-like" instructions that trick the AI into hiding content, redirecting users to phishing sites, or leaking data from other files. - Mitigation requires the implementation of robust guardrails that scan both the input data (the content being processed) and the generated output for instructional anomalies. ## Permission Risks in AI Agents and MCP - The use of Model Context Protocol (MCP) and coding agents creates risks where an agent might overstep its intended scope. - If an agent has broad access to a developer's environment, a malicious prompt in a public repository could trick the agent into accessing or leaking sensitive data (such as salary info or private keys) from a private repository. - Mitigation centers on the principle of least privilege, ensuring AI agents are restricted to specific, scoped directories and repositories. ## Embedding Inversion and Vector Store Vulnerabilities - Attacks targeting the retrieval phase of RAG (Retrieval-Augmented Generation) systems can lead to data leaks. - Embedding Inversion techniques may allow attackers to reconstruct original sensitive text from the vector embeddings stored in a database. - Securing AI products requires protecting the integrity of the vector store and ensuring that retrieved context does not bypass security filters. ## Automated Security Assessment Tools - To scale security, LY Corporation is developing internal tools like "ConA" for automated threat modeling and "LAVA" for automated vulnerability assessment. - These tools aim to identify AI-specific risks during the design and development phases rather than relying solely on manual reviews. Effective AI security requires a shift in mindset: treat every LLM response as a potential security risk. Developers should adopt automated threat modeling and implement strict input/output validation layers to protect both the application infrastructure and user data from evolving AI-based exploits.

Threat Modeling AI Large Language Models Model Context Protocol+5