Secure AI development
Models propose. Infrastructure decides. Evidence proves.
Coding agents write your code. Their output reaches your main branch. Agents act through tools with real credentials. Secure AI development puts a tested control at each point where a suggestion becomes an action, and keeps the evidence that it held.
Of the five control points, how many could you prove to an auditor today?
- Five control points, from prompt to production.
- A free tool and a test plan for each one.
- Open-source enforcement you can run before you call us.
Already shipped · Open source · Evidence-rated
Secure AI development is the practice of governing AI across the software lifecycle: the coding agents that write code, the AI-generated code that ships, and the agents that act in production. It places an enforced control at each point where model output becomes an action, tests that control with positive and negative cases, and keeps the results as evidence.
Last updated Tested against AI SAFE² v3.1 · safe2 CLI 1.1.0 · Gateway v3.0 · NEXUS v0.6By Vincent Sullivan
Where does your AI risk sit right now?
Your coding agent has your keys. It reads the repo, runs the shell and inherits your credentials.
Free tool: Coding Agent Baseline Generator
Secure AI coding practices45% of AI-generated code samples failed security tests in Veracode's study of more than 100 models.
Free tool: AI Code Debt Estimator
AI-generated code securityThe model proposes. The harness acts. Context, tools, memory and credentials meet in the loop around the model.
Free tool: Agent Harness Risk Grader
Agent harness securityA sandbox is a boundary, not a governance program. A microVM alone contains 2 of the 8 leak paths we test.
Free tool: Sandbox Escape and Leak Test Plan
Sandboxed AI agentsYour agent never reads the PDF. Turn the rule into allow, deny or escalate on every tool call.
Free tool: Starter Policy Pack, Rego and Cedar
Policy as code for AI agents02 · The program
What is secure AI development?
Five control points, in the order a change travels. Each has its own page, its own free tool and its own tests.
- Coding agentsPermissions, approvals and credentials for Claude Code, Cursor, Copilot and Codex.
- Generated codeFour failure layers and one merge gate that stops them.
- Agent harnessEight trust boundaries between the model and your systems.
- SandboxIsolation chosen by threat, then eight leak paths tested.
- Policy gateAllow, deny or a named human decides, with a receipt for every call.
03 · The evidence
Why AI needs controls outside the model
Use is rising faster than trust, and the defaults leave the decisions to you.
of code samples from more than 100 models failed security tests across 80 tasks in Java, Python, C# and JavaScript. Newer and larger models did not improve security.
Veracode · 2025 · 100+ modelsof developers trust AI output, while 84% use or plan to use AI tools, in Stack Overflow's 2025 survey.
Stack Overflow · 2025 surveyUntil local sandboxing is enabled, Copilot's shell commands run with your account's access: read, write, network and credentials without restriction.
GitHub Docs · Oct 202604 · Where it breaks
Where does secure AI development usually break?
One row per control point: the common failure, the control that stops it, and where to start.
| Control point | What goes wrong | The control | Start with |
|---|---|---|---|
| Coding agents | The agent runs shell commands with the developer's credentials and nobody approved them | Per-tool permissions, approval for risky commands, no standing secrets | Coding Agent Baseline Generator |
| Generated code | Insecure code merges because review assumes a human wrote it | A merge gate that scans AI-written changes and blocks below a threshold | AI Code Debt Estimator |
| Agent harness | A tool, memory store or MCP server carries an instruction the model follows | Trust boundaries on context, tools, memory and identity | Agent Harness Risk Grader |
| Sandbox | Data leaves through an allowed host with the agent's own token | Isolation plus egress control, a credential broker and protected config | Sandbox Escape and Leak Test Plan |
| Policy gate | The policy lives in a document, so no tool call is ever checked against it | Default-deny policy as code with three verdicts and a decision receipt | Starter Policy Pack |
CSI analysis · October 2026
05 · Architecture
How AI SAFE² structures the program
Five pillars cover every control point: sanitize and isolate, audit and inventory, fail-safe and recovery, engage and monitor, evolve and educate. The cross-pillar layer, CP.1 to CP.10, governs agents across all five.
The host backstop
Coding agents run on developer laptops, where most of these controls are optional settings.
Warden kernel-level containment holds unknown executables at the kernel by default, whatever the agent was allowed to run.
Read the framework itself on the AI SAFE² framework page.
06 · Proof in public
We did the work in public. Check it.
Every number below links to the file that proves it. Fork it, run it, try to break it.
README.md
19MCP profile controlsCP.5.MCP, MCP-1 to MCP-19, aligned to MCP 2026-07-28.00-cross-pillar/cp5_mcp_server_security.md
64scanner detection rulesJSON and SARIF output, fail-under gate in CI.scanner/README.md
22governed examplesClaude Code, Codex, Cursor, LangGraph, CrewAI, AutoGen, OpenClaw and more.examples/README.md
189NEXUS-A2A tests in the merge gateAgent-to-agent governance with OPA policies. Every PR must pass all of them.NEXUS/CONTRIBUTING.md
E0-E5evidence classesApplied to our own claims, in public, under Evidence Assurance v1.0.AISM/EVIDENCE-ASSURANCE.md
32frameworks mappedNIST AI RMF, ISO/IEC 42001, EU AI Act, OWASP and more, in the control dataset.safe2/data/ai-safe2-controls-v3.0.json
$0to read, run, fork or auditMIT and CC-BY-SA. NEXUS ships under Apache 2.0. No gate on the code.LICENSE
They define the risk. We ship the enforcement.
These bodies are the mapping targets, not the competition. AI SAFE² maps to them, then ships the code they leave to you.
| Who | Defines the risk | Maps to compliance | Open enforcement code for named agent stacks | Rates its own evidence in public | Published bypass process |
|---|---|---|---|---|---|
| OWASP GenAI Security Project | Yes | Partial | Not its scope | No | No |
| NIST AI RMF | Yes | Yes, it is the target | Not its scope | No | No |
| MITRE ATLAS | Yes | Partial | Not its scope | No | No |
| CSA MAESTRO and Agentic Control Plane | Yes | Partial | Not its scope | No | No |
| Runtime security vendors | Partial | Partial | Closed, own product only | Vendor reports | Some, through bug bounties |
| AI SAFE² | Yes, 161 controls | Yes, 32 frameworks | Yes, 22 examples, CLI, gateway | Yes, E0-E5 | Yes, Challenge Lab |
As of October 2026 · Got one wrong? Send the link. We correct it the same week.
Challenge Lab · C0 to C5 claim maturity
Break it.
Preregistered scenarios. Explicit invalidation criteria. A valid bypass or a grader defect is a high-value contribution, and it goes into the public record.
Or run it on yours, now
$ pip install "ai-safe2[all]==1.1.0" $ safe2 doctor . $ safe2 gate project . --fail-under 70 $ safe2 scan mcp https://your-host/mcp
Four commands. No sales call. If the gate fails, you just learned something your current vendor did not tell you.
Install line from MIGRATION.md. Commands from the safe2 CLI reference.
07 · Start here
Five free tools. Pick the one for your first gap.
Each tool runs on its page with no form. Use the result to decide whether you need us.
Free · 8 minutes
AI governance assessment
Not sure which control point comes first? Score your AI risk across all five and get the order to fix them in.
Enterprise program
Secure AI Development Architecture
- Scope
- All five control points across your coding agents, merge pipeline, agent harnesses, sandboxes and policy.
- Deliverables
- A control map per point, gaps ranked by consequence, and the tests that prove each control works.
- Timeline
- Agreed in writing at scoping, before work starts.
- Risk reversal
- Every control we recommend ships with its test, and you keep the results, pass or fail.
Want the five control points mapped to your stack?
One working session. You leave with the order to fix them in and the first test to run.
09 · FAQ
Straight answers on secure AI development
What is secure AI development?
It is the practice of governing AI across the software lifecycle, from the coding agents that write code to the agents that act in production. Each point where model output becomes an action gets an enforced control, a test, and kept evidence.
Where should we start?
Start where AI already acts with real credentials. For most teams that is coding agents on developer laptops. If you are unsure, the free 8-minute AI governance assessment gives you the order.
Is this only for coding agents?
No. Two control points govern code that AI writes. The other three, harness, sandbox and policy gate, govern any agent that calls tools, including support, finance and operations agents.
How does it map to compliance frameworks?
AI SAFE² maps its 161 controls to 32 frameworks, including NIST AI RMF, ISO/IEC 42001 and the EU AI Act. The mapping is in the public control dataset.
Do we have to buy anything to use it?
No. The framework, the safe2 CLI, the gateway and the examples are open source under MIT and CC-BY-SA, with NEXUS under Apache 2.0. The free tools on each page need no form.
Where does Warden fit?
Warden is the host backstop. Coding agents run on laptops, and Warden holds unknown executables at the kernel by default, whatever the agent was allowed to run.
10 · Sources and method
Sources, method and update log
External sources
CSI files cited
Method
External statistics name the publisher, year and sample. CSI claims link the repository file behind them and carry a rating under AI SAFE² Evidence Assurance v1.0: E1 for a specification, E2 for shipped code, E3 for a defined test with positive and negative cases. Vendor behavior comes from each vendor's current documentation, opened on the date shown.
Update log
- : page published. Vendor controls, repository counts and install line verified the same day.
Tested versions
AI SAFE² v3.1 · CP.5.MCP MCP-1 to MCP-19 · safe2 CLI 1.1.0 · Gateway v3.0 · NEXUS v0.6 · Evidence Assurance v1.0
Vincent Sullivan, founder and CEO of Cyber Strategy Institute. Twenty-two years as a U.S. Air Force cyber officer, finishing as Technical Director at U.S. Cyber Command. Author of the AI SAFE² framework.
The same AI SAFE² pillars also underpin CSI's agentic AI incident response doctrine (CSI-DOC-IR-001), which sets out how to contain and recover when an agent incident reaches production.