# Cheat Sheet

Course: [AI Security & Guardrails](https://www.devtutorials.ai/learn/ai-security) · Section: Reference
Source: https://www.devtutorials.ai/learn/ai-security/reference/cheat-sheet

> Every attack, control, OWASP entry, linter rule and coding-agent setting from the AI Security course on one page.

## AI Security Cheat Sheet

Every attack, control and setting from the course on one page. Use it as a lookup when you review an AI feature or a coding agent's settings.

## The One Rule

You cannot prompt your way to security. Rank defences from strongest to weakest:

1. **Architecture**: the capability is not there (no secret in the prompt, no email tool on the reader agent).
2. **Permissions**: least privilege, scoped to the signed-in user, approvals for exceptions.
3. **Deterministic checks outside the model**: encoding, schemas, allow-lists, caps.
4. **Classifiers**: useful signals with false positives.
5. **Prompt instructions**: speed bumps, never enough alone.

The lethal trifecta test: private data + untrusted content + a way out, in one agent. Remove a leg.

## OWASP Map

| Entry | Name | Lesson | Strongest control in the course |
|---|---|---|---|
| LLM01 | Prompt Injection | 2, 3, 12, 14 | Controls outside the model; break the trifecta; hooks |
| LLM02 | Sensitive Information Disclosure | 4 | Tool-layer scoping; PII filter; log redaction |
| LLM03 | Supply Chain | 10, 14 | Pinned MCP allow-list; dependency check |
| LLM04 | Data and Model Poisoning | 9 | Ingestion check and quarantine |
| LLM05 | Improper Output Handling | 5 | Encoding; validated filter + parameters |
| LLM06 | Excessive Agency | 6, 13 | Minimal tools; scoped tools; refund gate; agent lock-down |
| LLM07 | System Prompt Leakage | 2 | No secrets in the prompt; output check |
| LLM08 | Vector and Embedding Weaknesses | 9 | Tenant filter in the query |
| LLM09 | Misinformation | 9 | Approved sources only; citations |
| LLM10 | Unbounded Consumption | 11 | Per-user rate, token, spend and step caps; alerts |
| ASI01, ASI06 | Goal Hijack; Memory and Context Poisoning | 8 | Memory provenance |
| ASI03, ASI07 | Identity and Privilege Abuse; Inter-Agent Communication | 8 | Caller's permissions; handoffs are data |
| ASI04 | Agentic Supply Chain | 10 | Pinned MCP allow-list |
| ASI08 | Cascading Failures | 8, 11 | Step cap |

## Pipeline Stages

| Stage | Controls |
|---|---|
| 1. Input | Injection classifier (signal); your `checkInput` |
| 2. Model | Secrets out; reader agent; minimal tools; memory provenance; handoff check; labels |
| 3. Output | `checkOutput`; PII filter (others only); safe rendering |
| 4. Actions | Refund gate; scoped tools; validated report filter; egress allow-list; step cap |
| 5. Data | Ingestion check; tenant filter; log redaction |
| 6. Limits | Rate, tokens, spend per user; trace alerts |

## Linter Rules (Hints Only)

| Rule | Fires when | Fix in |
|---|---|---|
| unlabelled-untrusted | Retrieved text goes into the prompt unlabelled | Lesson 3 |
| side-effect-no-approval | A side-effect tool has no gate | Lesson 6 |
| unscoped-data | Tools are not scoped to the user | Lesson 4 |
| unencoded-output | Replies render as raw HTML, or the model writes SQL | Lesson 5 |
| no-caps | No rate, token, spend or step caps | Lesson 11 |
| trifecta | One agent has all three legs | Lesson 3 |

## Coding-Agent Settings

| Control | Claude Code | Codex | Cursor |
|---|---|---|---|
| File | `.claude/settings.json` | `.codex/config.toml` | `.cursor/cli.json`, `.cursor/hooks.json`, `.cursorignore` |
| Deny secret reads | `permissions.deny: ["Read(./.env)"]`, `sandbox.filesystem.denyRead` | Keep secrets outside the workspace; hook | `deny: ["Read(**/.env)"]`, `.cursorignore` |
| Sandbox | `sandbox.enabled` | `sandbox_mode = "workspace-write"` | Container or VM |
| Network | `sandbox.network.allowedDomains` | `[sandbox_workspace_write] network_access` | `deny: ["Shell(curl)"]` |
| Commands | `permissions.allow: ["Bash(npm test)"]` | `approval_policy = "on-request"` | `allow: ["Shell(npm)"]` |
| Hooks | `hooks.PreToolUse` (exit 2 blocks) | `[[hooks.PreToolUse]]` with `features.hooks` | `beforeShellExecution` etc. (`permission: deny`) |
| Project MCP | `enableAllProjectMcpServers: false`, `enabledMcpjsonServers` | Only reviewed `mcp_servers` | `beforeMCPExecution` hook |

Sources: [Claude Code settings](https://code.claude.com/docs/en/settings), [Claude Code hooks](https://code.claude.com/docs/en/hooks), [Codex configuration reference](https://developers.openai.com/codex/config-reference), [Cursor CLI permissions](https://cursor.com/docs/cli/reference/permissions). Checked October 2026; re-check each release.

## Secrets, Models and Incidents

| Topic | Do this | Lesson |
|---|---|---|
| Secrets at run time | Secret store + managed identity or IAM role; cache a few minutes; rotate; never log the value | 2 |
| Secret scanning | gitleaks pre-commit hook + CI on every pull request; allow-list fixtures with a reason | 13 |
| A committed key | Rotate first, then clean the history; forks and CI logs keep it | 2, 13 |
| Model weights | Pin a commit, check the hash, prefer safetensors, check the licence | 10 |
| Model vendor | No training on your data, stated retention, your region, SOC 2 / ISO 27001, pinned model versions | 10 |
| Incident | Alert → session timeline → where the content came from; traces keep tool arguments | 11 |

## Error Index

| Lab message | Meaning | Where to look |
|---|---|---|
| Prompt-only defence | Only prompt-level controls were on | Add a control outside the model |
| Over-blocking | Honest requests failed | Loosen the control; check its threshold or limit |
| Got through: FAMILY, VARIANT → EFFECT | One variant beat your defence | That family's lesson |
| Your guardrail code threw an error | `checkInput` or `checkOutput` crashed, so it let requests through | Fix the code; guard with try/catch |
| Honest coding task blocked | A lock-down setting broke build, test or install | Network allow-list, command allow-list |

## Compliance Pointers

| Framework | What it asks for | Pack file |
|---|---|---|
| EU AI Act, Article 15 (high-risk systems) | Accuracy, robustness and cybersecurity, including against data poisoning and adversarial inputs | `threat-model.md`, `tests/attacks.test.ts` |
| NIST AI RMF (Govern, Map, Measure, Manage) | Map risks, measure them, manage with controls | `threat-model.md` (Map), attack suite (Measure), guardrails (Manage) |

This is a pointer, not legal advice. Ask your compliance team which obligations apply to your system.