Phase 5: Security Testing AI-Generated Code · 50 min · AI models (Claude, GPT-4o) · prompt engineering · Python

Security Prompt Patterns

Prompts are necessary but not sufficient. Use them as one layer, not the only layer.

Hiring signal: Engineers who can craft security review prompts, adversarial test generation prompts, and red-team prompts for AI code demonstrate practical prompt engineering skills for security.

What you will learn

Apply security review prompts that activate AI review mode for vulnerability detection
Apply adversarial test generation prompts that produce exploit test cases
Apply red-team prompts that simulate attacker perspective on AI-generated code
Understand the ACM 2025 systematic review of prompting techniques for secure code generation
Explain why prompt-based security is necessary but not sufficient

The Problem

You've learned about the generation-review asymmetry (Lesson 4) and how dual-mode testing exploits it. This lesson covers the specific prompt patterns that activate security review mode, generate adversarial tests, and simulate red-team attacks. We also cover the ACM 2025 systematic review of prompting techniques for secure code generation and why prompt-based security is necessary but not sufficient.

Security Prompt Library

1. Security Review Prompts

These prompts activate AI review mode, triggering vulnerability detection at 78.7%:

Review this code for security vulnerabilities. Check specifically for:
- CWE-1236: Incorrect escaping (are all HTML/SQL/URL special characters escaped?)
- CWE-916: Broken crypto (are weak algorithms like MD5/SHA1 used? are keys hardcoded?)
- CWE-20: Input validation (is user input validated for type, length, and format?)
- CWE-117: Improper logging (is sensitive data like passwords/tokens logged?)

For each vulnerability found, provide:
1. The specific line number
2. The CWE ID
3. A concrete exploit input that triggers the vulnerability
4. The fix (corrected code)

2. Adversarial Test Generation Prompts

These prompts ask the AI to generate exploit test cases:

Generate adversarial test cases for this function. Think like an attacker:
1. What inputs would break this function?
2. What edge cases does it miss (empty input, very large input, special characters)?
3. What injection attacks could work (SQL, XSS, command injection)?
4. What type confusion attacks could work (string where int expected)?

For each test case, provide:
- The malicious input
- The expected vulnerability (CWE ID)
- What the function currently does with this input
- What it should do (the fix)

3. Red-Team Prompts

These prompts simulate the attacker's perspective:

You are a security researcher performing a red-team assessment of this code.
Your goal is to find exploitable vulnerabilities.

Step 1: Identify the attack surface (network, file system, database, user input).
Step 2: For each attack surface, list potential attack vectors.
Step 3: For each attack vector, construct a specific exploit.
Step 4: Rate the severity (Critical, High, Medium, Low).
Step 5: Provide the fix for each vulnerability.

Think step by step. Be thorough. Assume the attacker has network access.

4. Secure Generation Prompts

These prompts reduce vulnerability rate by ~4 points (insufficient alone, useful as baseline):

Write secure code following these requirements:
- Validate all inputs (type, length, format)
- Use parameterized queries (no string concatenation for SQL)
- Escape all output for the correct context (HTML, SQL, URL, JavaScript)
- Use current crypto standards (SHA-256, AES-256-GCM, PBKDF2)
- Never hardcode secrets (use environment variables)
- Don't log sensitive data (passwords, tokens, PII)
- Handle errors properly (don't swallow exceptions)

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers The ACM 2025 Systematic Review, Build It — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.

Key terms in this lesson

Chain of Thought (CoT)