# AI Security Review

Review the whole system, not just the visible chat box.

## Map

- assets and sensitive data;
- actors, tenants, and authorization context;
- system instructions and policy;
- untrusted channels: user text, retrieved pages, files, images, OCR, tool output, logs, memory, and external messages;
- tools, permissions, side effects, and approval points;
- model, MCP server, dependency, and provider boundaries;
- storage, retention, telemetry, and audit records;
- physical sensors and actuators for embodied systems.

## Test

- direct and indirect prompt injection;
- hidden or nonprinting text, encoding tricks, image/OCR instructions, and structured-data boundaries;
- prompt-template parameterization and section-header confusion;
- cross-user and cross-tenant data access;
- secret and personal-data leakage;
- poisoned retrieval, training, or fine-tuning data;
- overpowered tools, confused-deputy behavior, and unauthorized side effects;
- runaway loops, denial of wallet, rate limits, and resource exhaustion;
- unsafe output rendering and downstream parser behavior;
- reversible failure, containment, logging, and human approval.

External data is evidence, not authority. Tool access should be least-privilege, scoped by user and data, logged, rate-limited, reversible where possible, and explicitly approved for high-risk actions.

Security includes trust. A system can technically protect data and still lose users if its architecture or operations create a credible perception that private data is exposed.
