howtosecure.ai
Implementation guide OWASP AISVS v1.01

AI-Assisted Secure Coding (Appendix C) · AI Tool Qualification & Threat Modeling

Threat-model every AI coding tool

AISVS AC.2.1 Level 1

Verify that every AI tool, whether it is an assistant, a reviewer, an agent, or an MCP server, has a threat model. The threat model covers misuse, model inversion, training-data leakage, prompt injection from untrusted input, insecure output handling, excessive agency, and risk inherited from its dependency chain.

OWASP AISVS v1.01, requirement AC.2.1

In plain English

Threat-model every AI tool used in development before it is adopted. That includes assistants, review bots, agents and MCP servers. Each reads your code, and many can change it or run commands, so each needs the scrutiny you would give any privileged system.

What good looks like

  • Each tool has a threat model covering misuse, model inversion, training-data leakage, prompt injection from untrusted input, insecure output handling, excessive agency and risk inherited from its dependencies.
  • The threat model is finished before the tool is rolled out.
  • It is reviewed when the tool gains capabilities or changes its model.
  • MCP servers and plugins added to a tool get their own entries.

How teams usually do it

  • A short threat model template for AI tools, filled in during procurement or onboarding.
  • Using the OWASP Top 10 for LLM Applications and OWASP's agentic threat guidance as checklists.
  • Recording what the tool can read, what it can write and run, and what untrusted content reaches it.

Suggested evidence

  • Threat models for the tools in use, with dates.
  • The onboarding record showing the threat model came first.

Common mistakes

  • Threat-modelling the code assistant and not the MCP servers developers add to it.
  • A threat model written at adoption that still describes a tool with no agent mode.

Related requirements

AC.2.2 Evaluate each tool end to end · AC.2.3 Attack-test tools before adopting them

Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.

Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.