Practice

Responsible AI

Using AI in a security context creates obligations that are easy to skip. The points below are design constraints, not a certification.

All AI security topics

Human oversight

A person remains accountable for actions that change access, delete data, notify users, or publish a security conclusion. Model output is an input to that decision, not a replacement for it.

Secure development

Model endpoints, API keys, and any training corpora are sensitive assets. Protect them like other production credentials. Validate inputs that will be placed in a prompt the same way you validate any untrusted input.

Authorized research

Scanning, exploiting, or testing a system requires permission from the owner. Public educational material on this site is not authorization to attack any network, including those that use AI.

Known limits

Prompt injection, leakage through logs, hallucinated technical claims, and incomplete coverage of a threat are reasons to set limits. They are not reasons to avoid the tools entirely when the task is narrow and reviewed.