User input contains instructions to override system prompt. Defense: - Treat user input as untrusted - Use input validation - Output guardrails (Lakera, Aporia) - Sandbox tool execution

Indirect Prompt Injection

Email, doc, or webpage contains hidden instructions Claude reads. Defense: - Mark retrieved content as untrusted in system prompt - Strip suspicious patterns - Don't auto-execute actions based on retrieved content

Never in client code - Use server-side proxy - Rotate every 90 days - Use scope-limited keys - Store in secret manager (AWS, Doppler, 1Password)

Per-IP - Per-user (with auth) - Per-endpoint - Token-bucket algorithm

Scan inputs + outputs for credit cards, SSNs, emails (depending on policy). Tools: Presidio (Microsoft), Lakera.

Profanity filter - Brand safety filter - Code execution check (block os.system, eval)

For computer use / code interpreter: - Containerize (Docker, gVisor) - Network egress rules - No mounted secrets - Time limits

Logging Without Leaking

Log requests but redact: - API keys - User PII - Auth tokens

Bigger model ≠ more secure - Closed-source models have vendor support but no transparency - Open-source models you can audit but you maintain

AI Security Best Practices 2026 — Guide

AI Security Best Practices 2026

Your AI app has new attack surfaces traditional apps don't. This guide covers what matters. OWASP LLM Top 10 The community-defined top risks: 1. Prompt Injection 2. Sensitive Information Disclosure 3. Supply Chain 4. Data and Model Poisoning 5. Improper Output Handling 6. Excessive Agency 7. System Prompt Leakage 8. Vector and Embedding Weaknesses 9. Misinformation 10. Unbounded Consumption Promp…

All guides

Related guides

AI for Edge Computing 2026
AI Inference Optimization 2026
AI Prompt Engineer 2026
AI Agent Frameworks 2026
AI for Android Devs 2026