This category covers the infrastructure an AI feature sits on rather than the conversation: how the application authenticates to the model provider, what the model and its components were built from, and what stops a caller consuming an unbounded amount of a metered resource.

What an attacker is trying to achieve

The attacker wants the provider credential, the ability to run their own inference on the operator’s account, or simply to make the feature expensive enough to withdraw. None of this requires touching the model’s reasoning at all.

Test cases

4 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.

AI-PLAT-01 Provider Credential Exposure

Objective — Determine whether the credential the application uses to reach the model provider can be recovered or used by a caller.

How it is tested — Inspect client-side code, mobile packages, configuration endpoints and responses for provider keys. Establish whether the browser or app calls the provider directly — in which case the key is in the client by definition — or whether calls are proxied. Where a proxy exists, test whether it can be used as an open relay for arbitrary prompts and models by an authenticated but unentitled user.

Prerequisites — The client application and its traffic; an ordinary account; the architecture from the operator; a non-production environment with its own provider account.

Indicators — A provider key recoverable from the client; direct browser-to-provider calls; a proxy accepting arbitrary prompts or model names; no per-user attribution on proxied calls.

Coverage — LLM03CWE-798CWE-522

Depth — Hybrid Key scanning automates; establishing that a proxy is an open relay requires exercising it.

AI-PLAT-02 Model and Component Supply Chain

Objective — Establish what the AI feature is built from — models, adapters, embedding stores, orchestration libraries — and whether each comes from somewhere the operator controls or trusts.

How it is tested — Inventory the components and their versions, including models pulled from public hubs, fine-tuned adapters, and the orchestration framework. Establish whether artefacts are pinned and integrity-checked at load, or fetched by name at runtime. Compare versions against published advisories. Where a model is loaded from a serialised format capable of executing code, establish what validates it.

Prerequisites — The dependency and model inventory, or the deployment configuration; advisory data; read access to the loading path.

Indicators — A model or adapter fetched by name without pinning or integrity check; a serialisation format that can execute on load; an orchestration library materially behind current; components from an unverified publisher.

Coverage — LLM03LLM04CWE-1104CWE-494

Depth — Hybrid Inventory and advisory matching automate; judging whether a load path is safe requires reading it.

AI-PLAT-03 Unbounded Consumption and Cost

Objective — Determine whether a caller can consume a metered resource without limit, turning availability and cost into the same problem.

How it is tested — Establish what limits exist per request, per user, per period and in total — token ceilings, request rates, context size, retrieval breadth, agent step counts. Submit requests designed to maximise cost: very long inputs, instructions to produce very long outputs, prompts that trigger repeated retrieval or long tool chains. Measure the ratio between the effort to send and the cost to serve.

Prerequisites — Billing or quota visibility; a non-production environment with its own budget; explicit permission and an agreed spend ceiling.

Indicators — No ceiling on input or output length; unauthenticated access to a metered endpoint; cost scaling with a caller-supplied number; a single request occupying the feature for a sustained period.

Coverage — LLM10CWE-770CWE-400

Depth — Manual Every confirming result spends real money, so it is bounded and agreed in advance rather than swept.

AI-PLAT-04 Conversation and Prompt Data Retention

Objective — Determine where conversations and the material sent with them come to rest, and who can reach them afterwards.

How it is tested — Follow a conversation containing recognisable data through the system: application storage, provider-side retention, logs, traces, analytics and any evaluation or fine-tuning pipeline. Establish what the provider contract permits and whether the deployment matches it. Test whether deleting a conversation removes it everywhere, and whether an administrator or support tool can read another user’s history.

Prerequisites — The data-flow description and provider terms from the operator; an administrative account; access to logs and traces; an account whose conversation can be deleted.

Indicators — Conversation content in logs or traces; retention beyond the stated period; deletion that clears the interface but not the store; support tooling reading another user’s history without a record.

Coverage — LLM02CWE-359CWE-532

Depth — Manual Requires following data across systems and comparing against a contract, not a scan.

What we need from you

The deployment architecture — which provider, self-hosted or API, which components are bundled; access to the client application where one exists; billing or quota visibility for the consumption tests; and a non-production environment with its own budget.

Standards this category maps to

Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.

  • LLM03 — Supply Chain (OWASP Top 10 for LLM Applications 2025)
  • CWE-798 — Use of Hard-coded Credentials
  • CWE-522 — Insufficiently Protected Credentials
  • LLM04 — Data and Model Poisoning (OWASP Top 10 for LLM Applications 2025)
  • CWE-1104 — Use of Unmaintained Third Party Components
  • CWE-494 — Download of Code Without Integrity Check
  • LLM10 — Unbounded Consumption (OWASP Top 10 for LLM Applications 2025)
  • CWE-770 — Allocation of Resources Without Limits or Throttling
  • CWE-400 — Uncontrolled Resource Consumption
  • LLM02 — Sensitive Information Disclosure (OWASP Top 10 for LLM Applications 2025)
  • CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor
  • CWE-532 — Insertion of Sensitive Information into Log File