docs(security): add initial threat model for langchain monorepo

[John Kennedy (jkennedyvz)]

Summary

• Adds THREAT_MODEL.md at the repo root documenting the security posture of the langchain-ai/langchain monorepo
• Generated via deep-mode analysis (commit 494b760028) covering 10 components, 5 trust boundaries, 8 data flows, 8 threats, 7 out-of-scope patterns, and 2 investigated/dismissed findings
• Serves both human security reviewers and AI agents performing automated triage (consistent IDs: C/TB/DF/T/DC/D prefixes, file:SymbolName code references throughout)

[Mason Daugherty (mdrxy)]

Let's not version these

[0xbrainkid]

This threat model is an excellent starting point and the AI-agent-specific data flows (DF6/DF7/DF8) correctly identify where trust decisions need to happen.

One gap worth considering as a distinct threat: cross-organizational agent identity (T9). The current threats address the LangChain agent operating within a known trust boundary (the developer controls the environment). But production LangChain agents increasingly call external agents, tools, and APIs that they did not provision — and those external agents may impersonate legitimate counterparts.

Concrete scenario: A LangChain agent delegates a subtask to an external "billing tool" agent. Current threat model covers T4 (prompt injection) and T5 (malicious tool output). But if the external agent itself presents a falsified identity — claiming to be a verified financial processor when it is not — there is no model threat for that. This is distinct from prompt injection: it is identity fraud at the agent-to-agent handshake layer.

A potential T9 addition:

T9: External Agent Identity Spoofing
Affected components: C6 (LLM), C7 (Memory), C9 (External APIs/Tools)
Trust boundary: TB4 (LangChain ↔ External APIs)
Mitigations: 
  - Require W3C DID or on-chain attestation for external agent handshakes
  - Verify trust score before tool invocation (SATP, AgentScore)
  - Reject delegation to agents with no verifiable behavioral history

Happy to draft formal threat entry language if this direction is useful.