How to meet it
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Detection and Alerting
Watch AI traffic for covert channels
Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2) activity.
OWASP AISVS v1.01, requirement 12.2.6
In plain English
Watch traffic to model APIs for signs that malware is using them as a hidden communication channel.
What good looks like
- Traffic to model APIs from your network is monitored.
- Unusual patterns, such as unknown processes or encoded content, raise alerts.
- Approved clients are known.
How teams usually do it
- Egress monitoring and rules for model API domains.
Evidence an auditor would accept
- Monitoring rules and sample alerts.
Common mistakes
- Treating all traffic to model APIs as normal business use.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.