AI-Assisted Secure Coding (Appendix C) · Validation of AI-Generated Code
Fuzz the security-critical behaviour
Verify that differential fuzz testing or property-based tests cover the security-critical behaviors of AI-generated code: input validation, authorization logic, and deserialization safety.
OWASP AISVS v1.01, requirement AC.4.5
In plain English
Use fuzzing or property-based tests on the security-critical behaviour of AI-generated code: input validation, authorisation logic and deserialisation. These methods try inputs nobody thought to write an example for. This is a Level 3 control.
What good looks like
- Security-critical AI-generated code has fuzz or property-based tests.
- Where a reference implementation exists, differential tests compare the new code with it.
- The tests run in CI, and failures block merges.
- A person has reviewed the properties being tested.
How teams usually do it
- Property-based testing libraries such as Hypothesis (Python), fast-check (JavaScript) or proptest (Rust).
- Coverage-guided fuzzers such as libFuzzer, AFL++, Jazzer or Go's built-in fuzzing, with OSS-Fuzz-style continuous runs for important parsers.
- Properties such as "no input reaches the handler without passing validation" and "a user never gets access the policy denies".
Suggested evidence
- Test files.
- CI runs and any bugs found.
Common mistakes
- Relying on example-based tests that the same AI wrote, which share its blind spots.
- Properties so weak they can never fail.
- Fuzzing for thirty seconds in CI and calling it covered.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.