AI-Assisted Secure Coding (Appendix C) · AI Code-Review & Assistant Bot Hardening
Log review bot activity and watch egress
Verify that AI review and assistant bots log all prompts (including externally sourced context), tool calls, and outputs to tamper-evident storage. Egress patterns (URLs, IPs, DNS, payload sizes) are continuously monitored for exfiltration indicators, with alerting tuned for webhook, paste-site, and bin-service destinations.
OWASP AISVS v1.01, requirement AC.11.6
In plain English
Log everything a bot receives and does (prompts, external context, tool calls and outputs) in tamper-evident storage. Watch its outbound traffic for signs of data theft as well. An injected bot usually has to send what it stole somewhere, and that traffic is the point where you can catch it.
What good looks like
- Prompts (including externally sourced context), tool calls and outputs are all logged.
- Logs are in tamper-evident storage the bot cannot alter.
- Egress is monitored continuously: URLs, IP addresses, DNS queries and payload sizes.
- Alerts are tuned for exfiltration destinations such as webhook catchers, paste sites and request-bin services.
How teams usually do it
- Central logging from the bot runtime to append-only storage.
- An egress proxy or runner monitoring agent that records and alerts on outbound connections.
- DNS logging for the bot's network, since data can leave through DNS queries.
Suggested evidence
- Log samples covering context, tool calls and output.
- Egress alert rules and a test alert.
Common mistakes
- Logging the bot's output and not the context it read, which is where the injection was.
- Monitoring HTTP and ignoring DNS.
- Logs stored where the bot's own credentials can delete them.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.