How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Validation of AI-Generated Code
Fuzz the security-critical behaviour
Verify that differential fuzz testing or property-based tests cover the security-critical behaviors of AI-generated code: input validation, authorization logic, and deserialization safety.
OWASP AISVS v1.01, requirement AC.4.5
In plain English
Use fuzz testing or property-based tests on the security-critical behaviour of AI-generated code, such as input validation, authorisation and deserialisation.
What good looks like
- Security-critical AI-generated code has fuzz or property tests.
- Tests run in CI.
- Failures block merges.
How teams usually do it
- Property-based testing libraries and fuzzers for your language.
Evidence an auditor would accept
- Test files and CI runs.
Common mistakes
- Relying on example-based tests the AI also wrote.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.