AI Security & Guardrails Cheat Sheet
By Syncfusion®, Inc. · Last updated
Every attack, control, OWASP entry, linter rule and coding-agent setting from the AI Security course on one page.
What you will learn
- Look up the control for any OWASP LLM or ASI entry
- Find the coding-agent setting for each control
AI Security Cheat Sheet
Every attack, control and setting from the course on one page. Use it as a lookup when you review an AI feature or a coding agent's settings.
The One Rule
You cannot prompt your way to security. Rank defences from strongest to weakest:
- Architecture: the capability is not there (no secret in the prompt, no email tool on the reader agent).
- Permissions: least privilege, scoped to the signed-in user, approvals for exceptions.
- Deterministic checks outside the model: encoding, schemas, allow-lists, caps.
- Classifiers: useful signals with false positives.
- Prompt instructions: speed bumps, never enough alone.
The lethal trifecta test: private data + untrusted content + a way out, in one agent. Remove a leg.
OWASP Map
| Entry | Name | Lesson | Strongest control in the course |
|---|---|---|---|
| LLM01 | Prompt Injection | 2, 3, 12, 14 | Controls outside the model; break the trifecta; hooks |
| LLM02 | Sensitive Information Disclosure | 4 | Tool-layer scoping; PII filter; log redaction |
| LLM03 | Supply Chain | 10, 14 | Pinned MCP allow-list; dependency check |
| LLM04 | Data and Model Poisoning | 9 | Ingestion check and quarantine |
| LLM05 | Improper Output Handling | 5 | Encoding; validated filter + parameters |
| LLM06 | Excessive Agency | 6, 13 | Minimal tools; scoped tools; refund gate; agent lock-down |
| LLM07 | System Prompt Leakage | 2 | No secrets in the prompt; output check |
| LLM08 | Vector and Embedding Weaknesses | 9 | Tenant filter in the query |
| LLM09 | Misinformation | 9 | Approved sources only; citations |
| LLM10 | Unbounded Consumption | 11 | Per-user rate, token, spend and step caps; alerts |
| ASI01, ASI06 | Goal Hijack; Memory and Context Poisoning | 8 | Memory provenance |
| ASI03, ASI07 | Identity and Privilege Abuse; Inter-Agent Communication | 8 | Caller's permissions; handoffs are data |
| ASI04 | Agentic Supply Chain | 10 | Pinned MCP allow-list |
| ASI08 | Cascading Failures | 8, 11 | Step cap |
Pipeline Stages
| Stage | Controls |
|---|---|
| 1. Input | Injection classifier (signal); your checkInput |
| 2. Model | Secrets out; reader agent; minimal tools; memory provenance; handoff check; labels |
| 3. Output | checkOutput; PII filter (others only); safe rendering |
| 4. Actions | Refund gate; scoped tools; validated report filter; egress allow-list; step cap |
| 5. Data | Ingestion check; tenant filter; log redaction |
| 6. Limits | Rate, tokens, spend per user; trace alerts |
Linter Rules (Hints Only)
| Rule | Fires when | Fix in |
|---|---|---|
| unlabelled-untrusted | Retrieved text goes into the prompt unlabelled | Lesson 3 |
| side-effect-no-approval | A side-effect tool has no gate | Lesson 6 |
| unscoped-data | Tools are not scoped to the user | Lesson 4 |
| unencoded-output | Replies render as raw HTML, or the model writes SQL | Lesson 5 |
| no-caps | No rate, token, spend or step caps | Lesson 11 |
| trifecta | One agent has all three legs | Lesson 3 |
Coding-Agent Settings
| Control | Claude Code | Codex | Cursor |
|---|---|---|---|
| File | .claude/settings.json | .codex/config.toml | .cursor/cli.json, .cursor/hooks.json, .cursorignore |
| Deny secret reads | permissions.deny: ["Read(./.env)"], sandbox.filesystem.denyRead | Keep secrets outside the workspace; hook | deny: ["Read(**/.env)"], .cursorignore |
| Sandbox | sandbox.enabled | sandbox_mode = "workspace-write" | Container or VM |
| Network | sandbox.network.allowedDomains | [sandbox_workspace_write] network_access | deny: ["Shell(curl)"] |
| Commands | permissions.allow: ["Bash(npm test)"] | approval_policy = "on-request" | allow: ["Shell(npm)"] |
| Hooks | hooks.PreToolUse (exit 2 blocks) | [[hooks.PreToolUse]] with features.hooks | beforeShellExecution etc. (permission: deny) |
| Project MCP | enableAllProjectMcpServers: false, enabledMcpjsonServers | Only reviewed mcp_servers | beforeMCPExecution hook |
Sources: Claude Code settings, Claude Code hooks, Codex configuration reference, Cursor CLI permissions. Checked October 2026; re-check each release.
Secrets, Models and Incidents
| Topic | Do this | Lesson |
|---|---|---|
| Secrets at run time | Secret store + managed identity or IAM role; cache a few minutes; rotate; never log the value | 2 |
| Secret scanning | gitleaks pre-commit hook + CI on every pull request; allow-list fixtures with a reason | 13 |
| A committed key | Rotate first, then clean the history; forks and CI logs keep it | 2, 13 |
| Model weights | Pin a commit, check the hash, prefer safetensors, check the licence | 10 |
| Model vendor | No training on your data, stated retention, your region, SOC 2 / ISO 27001, pinned model versions | 10 |
| Incident | Alert → session timeline → where the content came from; traces keep tool arguments | 11 |
Error Index
| Lab message | Meaning | Where to look |
|---|---|---|
| Prompt-only defence | Only prompt-level controls were on | Add a control outside the model |
| Over-blocking | Honest requests failed | Loosen the control; check its threshold or limit |
| Got through: FAMILY, VARIANT → EFFECT | One variant beat your defence | That family's lesson |
| Your guardrail code threw an error | checkInput or checkOutput crashed, so it let requests through | Fix the code; guard with try/catch |
| Honest coding task blocked | A lock-down setting broke build, test or install | Network allow-list, command allow-list |
Compliance Pointers
| Framework | What it asks for | Pack file |
|---|---|---|
| EU AI Act, Article 15 (high-risk systems) | Accuracy, robustness and cybersecurity, including against data poisoning and adversarial inputs | threat-model.md, tests/attacks.test.ts |
| NIST AI RMF (Govern, Map, Measure, Manage) | Map risks, measure them, manage with controls | threat-model.md (Map), attack suite (Measure), guardrails (Manage) |
This is a pointer, not legal advice. Ask your compliance team which obligations apply to your system.