AI-Assisted Secure Coding (Appendix C) · Continuous Feedback, Adversarial Testing & Model Fine-Tuning
Red-team the AI tooling
Verify that scheduled red-team exercises target the AI tooling itself. The exercises include direct and indirect prompt-injection probes delivered through realistic PR, issue, and comment surfaces, jailbreak corpora, and supply-chain payload generation. Findings are remediated under tracked severity SLAs.
OWASP AISVS v1.01, requirement AC.6.3
In plain English
Run red-team exercises against the AI development tooling itself, on a schedule. Attack it the way an outsider would, through pull requests, issues and comments, and fix what is found within deadlines set by severity.
What good looks like
- Exercises run on a defined schedule.
- They include direct and indirect prompt injection through realistic PR, issue and comment content, jailbreak suites, and attempts to make the tool generate supply-chain payloads.
- Findings are rated and fixed under tracked severity deadlines.
- Fixes are re-tested.
How teams usually do it
- An internal red team or an outside firm, with a scope that names the assistants, review bots and agents.
- Reusing the test repository from AC.2.3 and adding new techniques each round.
- Tracking findings in the same system as other vulnerabilities, with the same SLAs.
Suggested evidence
- Exercise reports.
- Remediation tracking with dates against the SLA.
Common mistakes
- Red-teaming the product's AI features and never the development tools.
- Findings with no owner or deadline.
- Testing in a lab copy that lacks the production bot's permissions and secrets.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.