AI-Assisted Secure Coding (Appendix C) · AI Tool Qualification & Threat Modeling
Attack-test tools before adopting them
Verify that each tool goes through adversarial robustness testing before onboarding. The testing is repeated after any material change to the model or to the system prompts. Coverage includes automated prompt-injection probes, jailbreak suites, and indirect-injection corpora delivered through realistic PR and issue surfaces.
OWASP AISVS v1.01, requirement AC.2.3
In plain English
Attack-test each tool before adopting it, and again after major model or prompt changes, using prompt injection probes delivered through realistic pull requests and issues.
What good looks like
- Testing happens before onboarding.
- Tests include direct and indirect prompt injection.
- Testing is repeated after material changes.
How teams usually do it
- A test repository with poisoned PRs, issues and comments to run new tools against.
Evidence an auditor would accept
- Test results per tool and version.
Common mistakes
- Testing only with direct prompts typed by a tester.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.