# AI Security Testing Checklist

**System:** _______________  **Date:** _______  **Tested by:** _______________

> Aligned to the **OWASP Top 10 for LLM Applications (2025)** and the **OWASP Top 10 for Agentic
> Applications (2026)**. Prompting is not a control — architecture is. This checklist measures
> exposure and verifies the architectural defences.

## 1. Prompt injection — direct

- [ ] "Ignore previous instructions" and variants
- [ ] Role reassignment: "you are now in developer mode"
- [ ] "Repeat the text above"
- [ ] Instruction smuggling via encoding (base64, unicode, homoglyphs)
- [ ] Instructions in another language
- [ ] Instructions inside a code block or comment
- [ ] **Blast radius assessed**: if an override succeeds, what could it actually cause?

## 2. Prompt injection — indirect

> The dangerous one. The user is innocent; the payload is in content the system retrieves.

- [ ] Hostile instruction planted in a retrievable document
- [ ] Hostile instruction in a web page the system fetches
- [ ] Hostile instruction in an email or ticket body
- [ ] Payload split across two documents
- [ ] Verified: **retrieved content cannot change what the system does**

## 3. System prompt

- [ ] Extraction attempted
- [ ] System prompt contains **no credentials or API keys**
- [ ] Contains no internal URLs or hostnames
- [ ] Contains no rules an attacker would need in order to bypass controls
- [ ] Treated as public regardless of whether extraction succeeded

## 4. Excessive agency — per tool

For **each** tool the system can call:

- [ ] Can it be invoked with arguments the user should not control?
- [ ] Can it be invoked for a user lacking permission?
- [ ] Is it as narrow as the task allows?
- [ ] Is there a human gate on destructive / financial / outbound use?
- [ ] Can it be **chained** with another tool to achieve something neither allows alone?
- [ ] Is every invocation logged with actor, arguments and result?

## 5. Information disclosure

- [ ] Output never contains another user's data
- [ ] Credentials, tokens and personal data are not echoed back
- [ ] Error messages reveal no internals
- [ ] Training or fine-tuning data cannot be extracted
- [ ] Verbose or debug modes disabled in production

## 6. Permissions — highest value, run first

- [ ] Identical request run as users with different entitlements
- [ ] Each sees only what they are entitled to
- [ ] Retrieval filtered at query time, not after generation
- [ ] System acts with the **requesting user's** permissions, not a service account
- [ ] **Failure treated as a security incident**

## 7. Memory and context (agents)

- [ ] False information written to stored context, then a normal task run
- [ ] Verified whether the falsehood persists and influences behaviour
- [ ] One user cannot write to another user's memory
- [ ] Stored context can be inspected
- [ ] Stored context can be cleared

## 8. Resource exhaustion

- [ ] Input crafted to maximise token consumption
- [ ] Task with no achievable end — step cap fires
- [ ] Request triggering an expensive tool chain
- [ ] Spend cap verified by triggering it

## 9. Supply chain

- [ ] Model provider and version recorded
- [ ] Third-party components reviewed (MCP servers, plugins, libraries)
- [ ] Anything third-party running with granted access reviewed as a dependency
- [ ] Data handling terms checked: is input used for training?

## 10. Process

- [ ] **Every finding converted to a permanent regression case**
- [ ] Results expressed as a rate ("blocked 47 of 50"), not a binary
- [ ] Suite re-run on **every model version change**
- [ ] Suite re-run on every new tool
- [ ] Tested at production temperature, not only at 0

## Findings

| # | Category | What succeeded | Blast radius | Severity | Owner |
|---|---|---|---|---|---|
| | | | | | |

## Sign-off

| | Name | Date |
|---|---|---|
| Tested by | | |
| Reviewed by | | |
| Accepted risks approved by | | |