AI Security Self-Assessment

Is there written, explicit authorization covering any AI systems you test, including third-party models and MCP servers you do not own?

Note: Check regional regulations (GDPR, AI Act) and contractual obligations before testing.

Have you classified the data your models and agents touch, and excluded production personal data from testing environments?

Note: An untested staging copy of real customer data is still regulated data.

Do you treat model input as untrusted, with a documented boundary between instructions and retrieved or user-supplied content?

Note: This is OWASP LLM01. Most real breaches start here.

Is model output treated as untrusted data at every downstream sink, rather than being passed straight to a shell, SQL, or template?

Note: OWASP LLM05: Improper Output Handling.

Do your MCP servers and agent tools enforce authentication and per-tool authorization, rather than exposing every tool to any caller?

Note: Several 2026 CVEs scored 10.0 purely because SSE transport shipped without auth.

Are agent actions bounded by least privilege, with approval gates and spend or step limits on autonomous loops?

Note: OWASP LLM06: Excessive Agency.

Do you control what enters your RAG corpus and fine-tuning data, and can you trace a retrieved chunk back to an authorized source?

Note: OWASP LLM04 and LLM08: poisoning and embedding store access control.

Are secrets, credentials, and system prompts kept out of context that an attacker can influence, and are they prevented from being echoed back?

Note: OWASP LLM02 and LLM07.

Do you log model and agent activity in a form that lets you reconstruct what a request did, including tool calls and retrieved context?

Note: Without this you cannot investigate an incident at all.

Is there a documented path to pull a model or agent back once a prompt injection or tool abuse is suspected?

Note: Revoking credentials and disabling tools beats patching mid-incident.