Code and Prebuild

Securing AI-Assisted Development and AI Application Design

Artificial intelligence is changing how software is designed and developed. AI coding assistants generate application code, autonomous agents modify repositories and dependencies, and AI models are increasingly incorporated into software applications. While these capabilities accelerate development, they introduce security risks that traditional development practices may not fully address.

Phase 1: Code and Prebuild focuses on establishing security controls before code, AI models, prompts, datasets, or autonomous agents enter the CI/CD delivery pipeline.

This phase extends established secure development practices to address AI-generated code, agent permissions, AI application threat modeling, model and data supply chain security, and the protection of AI configurations.

The objective is to identify and reduce security risks early in the software development lifecycle, before vulnerabilities or unsafe configurations are introduced into build and deployment processes.

Code and Prebuild Outcomes

By implementing these practices, development teams establish a security foundation for AI-assisted software development and AI application design.

Expected outcomes include:

• AI-generated code is subject to established secure development practices.
• Autonomous development agents operate with controlled identities and permissions.
• AI-specific application threats are identified before implementation.
• AI models, datasets, and dependencies are evaluated for security and provenance.
• Prompts, agent instructions, and configurations are protected through version control and review.
• Security requirements are documented for validation during build and deployment.

These outcomes prepare development artifacts for the automated security validation activities described in Phase 2: Build and Deploy.

Why AI Security Begins Before the Build

Traditional secure development practices focus on source code quality, dependency management, secrets protection, and secure application design. AI-assisted development introduces additional considerations. This phase will cover: