new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

ai agent security/human-in-the-loop

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Human-in-the-loop high-risk keyword list for prompt injection

Flag requests containing high-risk keywords for human review: password, api_key, admin, system, bypass, override. Additionally, flag requests containing injection patterns: "ignore instructions", "developer mode", "reveal prompt". Assign risk score of 1 per high-risk keyword and 2 per injection pattern. Flag for human approval if combined risk score meets or exceeds threshold of 3.

Human developers retain accountability for AI-generated code

AI-generated code must have a human owner. Every AI-assisted change should be reviewed, approved, and attributable to a developer who is responsible for its security and maintainability. AI tools do not accept responsibility for the code they generate. The developer who accepts and commits the code does.

Do: Establish clear human ownership and accountability

Assign a human owner to every AI-generated code change who is responsible for its correctness, security, and maintenance. Require explicit developer approval before merging any AI-generated code—this approval indicates the developer has reviewed and understood the change. Maintain audit trails showing which developer approved which AI-generated changes, including the AI tool and model version used. Treat AI as a tool, not a colleague.

Don't: Deploy AI code without human approval or shift accountability

Do not deploy AI-generated code that no human has reviewed and approved. Do not allow AI-generated code to bypass code review because the AI is usually right. Do not treat AI approval (e.g. AI-generated code review comments) as a substitute for human review. Do not attribute security failures to the AI tool—the developer who approved the code is accountable.

Give your agent this brain