AI Application Security

An AI feature does not replace familiar application risks; it adds a component whose instructions and outputs are not reliably separated from data. Attackers may place instructions in user input, websites, emails, or retrieved documents. If the application treats model output as trusted code or authority, indirect prompt injection can become data access, unsafe actions, insecure rendering, or downstream injection.

Other concerns include weak authentication, excessive context, denial-of-wallet, vulnerable dependencies, exposed prompts or keys, insecure plugin design, and insufficient evaluation after model or prompt changes. A model refusal is not an authorization control.

The recommended pattern keeps authorization and business rules in deterministic services. An AI gateway authenticates callers, constrains requests, selects approved models, and records appropriate metadata. Retrieval enforces source permissions. Tool calls use typed schemas, narrow service identities, server-side validation, and approvals based on impact. Outputs are encoded or validated for their destination, and untrusted model text never directly forms database, shell, browser, or infrastructure commands.

An engagement may include architecture review, AI-focused threat modeling, code-path review, abuse-case design, prompt-injection exercises, dependency and secret handling review, and CI/CD evaluation guidance. Deliverables are selected during scoping and may include findings, reference controls, test cases, release gates, and remediation advice. Testing is time-bound and cannot prove the absence of exploitable behavior.

Work can address managed APIs, cloud AI services, self-hosted models, browser or mobile features, and internal platforms. Depth depends on source access, environment safety, data classification, model constraints, and agreed rules of engagement. Reviews can start at design, before production release, or around a material change.

Common uses include retrieval assistants, customer chat, code assistance, document processing, and workflow agents across software, finance, healthcare, public sector, retail, and industrial organizations. Related technologies include SAST, DAST, software composition analysis, API security, IAM, secrets management, WAFs, observability, and model evaluation harnesses. This solution does not claim universal attack detection, compliance certification, or guaranteed secure operation.