THREAT MODELING OF AUTONOMOUS CODING AGENTS IN CORPORATE MOBILE DEVELOPMENT. PART 1: SYSTEM MODEL, ASSETS, TRUST BOUNDARIES, AND ATTACK SURFACES

Abstract

. Autonomous coding agents built on large language models increasingly execute mobile-development tasks directly inside corporate environments, where they access a virtual private network (VPN) with multi-factor authentication (MFA), Jira, GitLab, application-signing keys, Model Context Protocol (MCP) extensions, plugins, git hooks, and isolated git worktrees on macOS workstations. Although individual attack vectors against tool-integrated agents — indirect prompt injection, memory poisoning, supply-chain compromise, secret leakage, and insecure code generation — are well studied in isolation, no integrated model captures the full developer-side agent toolchain as a single system. This article, the first of a four-part series, establishes the methodological and system-model foundation. Its aim is to specify the system under analysis and to fix a reproducible threat-modeling methodology on which the remaining parts build. The methodology is convergent, combining a data-flow diagram (DFD) annotated with trust boundaries, attack-surface