Your AI Code Has Security Holes That Traditional Scanners Can't See

Your SAST tool was designed for a world where code takes input, processes it deterministically, and returns output. AI code breaks every one of those assumptions. Inputs are natural language. Processing is probabilistic. Outputs are unpredictable. And the attack surface is unlike anything your scanner has ever seen.

The Blind Spot in Your Security Toolchain

Run your favorite SAST tool against a codebase that integrates LLMs. It will find the usual suspects — SQL injection, XSS, hardcoded credentials. It will completely miss:

• Prompt injection vulnerabilities that let attackers hijack your AI agent's behavior
• Insecure output handling that trusts model responses as safe data
• RAG poisoning vectors where retrieval pipelines pull malicious content into prompts
• Agent security flaws where autonomous AI agents have excessive permissions
• Training data extraction attacks that leak sensitive data through model responses

This isn't a gap — it's a chasm. Traditional scanners don't have rules for these vulnerability classes because they didn't exist three years ago. The security toolchain was built for deterministic software, and AI code is anything but.

Aribot's AI/ML Security Review scanning for OWASP LLM Top 10 vulnerabilities

The OWASP LLM Top 10 Is Real

In 2025, OWASP released the LLM Top 10 — the definitive taxonomy of risks specific to large language model applications. These aren't theoretical. They're being exploited in production today.

LLM01: Prompt Injection

The most prevalent and dangerous vulnerability in LLM applications. Attackers craft inputs that override the system prompt, causing the model to ignore its instructions and follow the attacker's instead. Direct injection targets user-facing inputs. Indirect injection embeds malicious instructions in data the model retrieves — emails, documents, web pages.

LLM02: Insecure Output Handling

LLM outputs are treated as trusted data by downstream systems. When model output is rendered in HTML without sanitization, you get XSS. When it's passed to a SQL query, you get injection. When it's executed as code, you get remote code execution. The model becomes a laundering service for malicious payloads.

LLM03: Training Data Poisoning

Attackers manipulate training data to embed backdoors in the model's behavior. The model performs normally on standard inputs but behaves maliciously when triggered by specific patterns — a sleeper agent in your inference pipeline.

LLM04: Model Denial of Service

Carefully crafted inputs consume disproportionate compute resources, causing model denial of service. Unlike traditional DoS, these attacks often slip through rate limiters because they look like legitimate requests.

LLM05: Supply Chain Vulnerabilities

Compromised model weights, poisoned fine-tuning datasets, and malicious model hub packages create supply chain risks unique to AI. You're not just trusting code dependencies — you're trusting billion- parameter models whose behavior you can't fully inspect.

LLM06: Sensitive Information Disclosure

Models inadvertently reveal sensitive training data, system prompts, or context window contents. Attackers use prompt techniques to extract confidential information that was never intended to be accessible through the application interface.

What We Actually Scan For: 86 Patterns

We've built a purpose-designed scanner that understands AI code at a semantic level. It's not looking for generic patterns — it's looking for the specific code constructs that create AI-specific vulnerabilities. Here's what the 86 patterns cover:

Prompt Injection — 10 Variants

We detect direct and indirect injection vectors, including:

• User input concatenated directly into system prompts without sanitization
• Missing prompt/response boundary enforcement
• System prompts exposed in client-side code
• Template injection through f-strings and format methods in prompt construction
• Indirect injection via RAG context, tool outputs, and retrieved documents

# VULNERABLE: User input directly in system prompt
prompt = f"""You are a helpful assistant.
User request: {user_input}
Please respond helpfully."""

response = client.chat.completions.create(
    model="gpt-4",
    messages=[{"role": "system", "content": prompt}]
)

Jailbreak — 15 Variants

Jailbreak patterns that bypass model safety guardrails:

• Missing input validation on prompt length and character sets
• No content filtering on model inputs or outputs
• Absent or bypassable safety system prompts
• Role-play and persona-switching vectors
• Multi-turn conversation manipulation patterns

Insecure Output Handling — 12 Patterns

Patterns where model output is used unsafely:

• Model output rendered as HTML without sanitization
• Model output passed to eval(), exec(), or shell commands
• Model output used in SQL queries, file paths, or API calls without validation
• Model-generated code executed without sandboxing
• JSON/XML from model responses parsed without schema validation

// VULNERABLE: Model output executed as code
const aiResponse = await model.generate(userPrompt);
const result = eval(aiResponse.code);  // RCE via model output

Agent Security — 18 Patterns

AI agents introduce a new attack surface — autonomous code that makes decisions and takes actions:

• Agents with excessive tool permissions (file system, network, database)
• Missing human-in-the-loop for destructive actions
• Unbounded agent loops without termination conditions
• Tool-use injection where adversarial inputs trigger unintended tool calls
• Agent memory poisoning through persistent conversation state
• Missing audit logging for agent decisions and actions

RAG Security — 14 Patterns

Retrieval-Augmented Generation creates a pipeline from data sources to model context — and every step is an attack surface:

• Document ingestion without content sanitization
• Missing access control on retrieval — users seeing documents they shouldn't
• Embedding poisoning through malicious document injection
• Context window overflow attacks via document stuffing
• Instruction injection embedded in retrieved documents

Training Data & Model Security — 17 Patterns

Covering the model lifecycle from training to deployment:

• Insecure model serialization (pickle deserialization, unsafe model loading)
• Model files loaded from untrusted sources without integrity verification
• Training data containing PII without anonymization
• Fine-tuning datasets without provenance tracking
• Missing model version pinning allowing supply chain attacks

# VULNERABLE: Pickle deserialization of untrusted model
import pickle
with open("downloaded_model.pkl", "rb") as f:
    model = pickle.load(f)  # Arbitrary code execution

Mapped to Frameworks That Auditors Care About

Every finding is mapped to the compliance frameworks that matter for audit readiness:

MITRE ATLAS

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is the ATT&CK equivalent for AI/ML systems. Each finding maps to specific ATLAS tactics and techniques, giving your red team the language to describe AI attacks and your blue team the framework to defend against them.

EU AI Act

The EU AI Act requires technical documentation of AI system security measures. Our findings map to specific EU AI Act articles and annexes, generating audit-ready evidence that demonstrates compliance — or highlights gaps that need attention before regulators come knocking.

NIST AI RMF

The NIST AI Risk Management Framework's "Measure" and "Manage" functions require ongoing vulnerability assessment of AI systems. Our scanner outputs align with NIST AI RMF categories, making it straightforward to demonstrate continuous security monitoring to auditors and procurement teams.

Real Findings From Real Code

Here are four sanitized examples from recent scans — names and details changed, vulnerability patterns preserved:

Finding 1: Prompt Injection in Customer Support Bot

A customer support chatbot concatenated user messages directly into the system prompt. An attacker could override the bot's instructions to extract the full system prompt — which contained internal API endpoints and authentication details.

Finding 2: Insecure Output in Code Generation Tool

An internal code generation tool used eval() to execute model-generated Python code without sandboxing. The model could be prompted to generate code that accessed the file system, environment variables, and network — effectively giving any user root-equivalent access through the AI interface.

Finding 3: RAG Poisoning in Legal Document Search

A legal document search system ingested documents from a shared drive without content sanitization. An attacker could upload a document containing embedded prompt instructions that would be retrieved and injected into the model context for other users' queries.

Finding 4: Agent with Unrestricted Database Access

An AI agent designed to answer business intelligence questions had direct SQL execution access to the production database — with a service account that had write permissions. A carefully crafted natural-language query could trick the agent into executing destructive SQL statements.

Why Fix Suggestions Matter

Identifying vulnerabilities is only half the job. AI security is new enough that most developers don't know how to fix these issues. Traditional remediation guidance ("sanitize user input") doesn't translate directly to AI-specific vulnerabilities.

Every finding includes:

• A specific fix — Not "validate input" but "implement a prompt boundary using XML tags and validate model output against this JSON schema before rendering."
• A code example — The fixed version of the vulnerable pattern, ready to adapt.
• An explanation — Why the fix works, what attack it prevents, and what residual risk remains.
• Framework references — Which OWASP LLM Top 10 item, MITRE ATLAS technique, and compliance control this fix addresses.

The Gap Is Growing

Every month, AI adoption accelerates while AI security tooling lags behind. New model capabilities — tool use, autonomous agents, multi- modal inputs — create vulnerability classes that didn't exist last quarter. Traditional security tools can't keep up because they weren't designed for this paradigm.

The organizations that will navigate this safely aren't the ones that avoid AI. They're the ones that scan for AI-specific vulnerabilities with the same rigor they apply to traditional code security. The OWASP LLM Top 10 isn't optional reading — it's the new baseline.

Your AI code has security holes. The only question is whether you find them before an attacker does.