Secure Development Lifecycle Integration

Threats mitigated

• T1 Memory Poisoning

  Attackers inject malicious data into the agent's memory to manipulate future decisions, affecting any memory type from in-agent session to cross-agent cross-user memory.

• T2 Tool Misuse

  Manipulation of tools, APIs, or environment access to perform unintended actions or access unauthorized resources, including exploitation of access to external systems.

• T3 Privilege Compromise

  Breaking information system boundaries through context collapse, causing unauthorized data access/leakage, or exploiting tool privileges to gain unauthorized access to systems.

• T5 Cascading Hallucination Attacks

  Foundation models generate incorrect information that propagates through the system, affecting reasoning quality and being stored in memory across sessions or agents.

• T6 Intent Breaking & Goal Manipulation

  Attacks that manipulate the agent's core decision-making to achieve unauthorized goals, breaking control flow, abusing shared context, or interfering with isolated data.

• T7 Misaligned & Deceptive Behaviors

  Model alignment issues leading to unintended behaviors that impact users, organizations, or broader populations through subtle reasoning or tool usage misalignments.

• T8 Repudiation & Untraceability

  Making agent actions difficult to trace through workflow manipulation, obscuring decision trails in reasoning chains, or tampering with evidence in memory.

• T9 Identity Spoofing & Impersonation / Agent Identity Compromise

  Impersonating trusted agents, users or services, or taking over an agent's own persistent identity and credentials, to act under a trusted identity.

• T10 Overwhelming Human in the Loop

  Bypassing human oversight in workflows by creating excessive activity requiring approval, leading to notification fatigue and reduced scrutiny.

• T11 Unexpected RCE and Code Attacks

  Tools or environments enabling unexpected code execution, presenting direct risks to code execution environments.

• T12 Agent Communication Poisoning

  Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.

• T13 Rogue Agents in Multi-Agent Systems

  Compromised AI agent activity outside monitoring limits or orchestration in multi-agent systems.

• T14 Human Attacks on Multi-Agent Systems

  Exploits trust relationships between agents and workflows to manipulate human operators.

• T15 Human Manipulation

  Models exploit human trust to manipulate users, leveraging reasoning capabilities or operational access to influence human decisions.

• T17 Supply Chain Compromise

  Vulnerable, malicious or outdated components enter the agent through models, libraries, tools, plugins, prompt templates, build environments or framework updates.

OWASP AISVS coverage

The AISVS 1.01 chapters and verification requirements this control helps satisfy.

C3 Model Lifecycle Management & Change Control

• C3.1.1 Level 1

  Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.

• C3.3.1 Level 2

  Verify that production deployments implement rollout mechanisms with automated rollback triggers.

• C3.4.1 Level 1

  Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).

• C3.4.2 Level 2

  Verify that model training and fine-tuning environments are isolated from production environments.

C4 Infrastructure, Configuration & Deployment Security

• C4.1.1 Level 1

  Verify that AI models execute in isolated sandboxes.

C6 Supply Chain Security for Models

• C6.1.4 Level 2

  Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.

Design phase

Architecture, threat modelling and policy decisions made before code is written. 5 tasks.

Security by Design Planning

• Run threat modeling for every architecture change and major feature
• Define security acceptance criteria per release (blocking and non-blocking)
• Require design reviews for high-risk capabilities (code execution, memory, tool use)
• Maintain clear data classification and handling requirements across components
• Document secure defaults, trust boundaries, and rollback procedures

Build phase

Implementation, testing and hardening while the agent is developed. 11 tasks.

Shift-Left Security Controls

• Enforce automated checks in CI/CD:
  • Static analysis and linting
  • Dependency vulnerability and license scanning
  • Secret detection in commits and build artifacts
  • Policy tests for unsafe prompt/tool patterns
• Add security-focused test suites:
  • Prompt-injection regression tests
  • Tool abuse and sandbox escape tests
  • Memory poisoning and leakage tests
  • Access-control and identity spoofing tests
• Block promotions when critical security checks fail without explicit, auditable overrides

Operations phase

Monitoring, response and continuous improvement once the agent is live. 5 tasks.

Continuous Security Operations

• Monitor production for security regressions after each deployment
• Track MTTR for security findings and enforce remediation SLAs
• Run recurring red-team and tabletop exercises for AI-specific threats
• Keep incident runbooks, postmortems, and corrective actions in a shared knowledge base
• Review and update security baselines as threat intelligence changes

Tools and frameworks

Common Tooling

• CI/CD Security: GitHub Actions, GitLab CI, Jenkins
• SAST/Code Scanning: CodeQL, Semgrep, SonarQube
• Dependency & Supply Chain: npm audit, Snyk, OWASP Dependency-Check
• Secret Scanning: Gitleaks, TruffleHog
• Dynamic/Abuse Testing: OWASP ZAP, custom adversarial AI test harnesses

Related controls

• M6 Comprehensive Security Monitoring & Auditing shares T8, T13, T14, T2, T3, T17
• M17 Supply Chain Security & Provenance shares T1, T2, T3, T11, T13, T17
• M18 Incident Response & Recovery Framework shares T8, T13, T11, T3, T2, T17
• M4 Prompt Hardening & Jailbreak Prevention shares T5, T6, T7, T15, T1

References

• OWASP SAMM
• NIST Secure Software Development Framework (SSDF)
• CISA Secure by Design