Claude Code Tools

AI Security Audit Prompts: 6 for the Flaws That Actually Shipped in 2026

Every major AI security incident this year reduced to the same thing: untrusted input reaching something that executes. The Snowflake workflow injection put issue titles into a CI run block. The Ray CVE left an endpoint that runs code guarded by a header string anyone can spoof. Forcepoint hid instructions in white-on-white zero-size email text that reached the model but not the reader. These six prompts point a model at those specific patterns rather than asking it to find bugs in general.

⌨️ 6 prompts 🕐 Updated Aug 28, 2026

💡 How to use these prompts: Replace everything in [BRACKETS] with your specific details before sending. Click Copy to copy any prompt to your clipboard instantly.

Audit a CI workflow for injection

This is the exact pattern behind the Snowflake incident. Most reviewers are not pointed at workflow files by default.

Review the workflow file below for these four issues specifically:

1. Untrusted input expanded directly into a run block. Issue titles, PR titles, branch names, comment bodies, fork metadata
2. Sanitisation applied after template expansion rather than before
3. Conditionals referencing one event context on a workflow triggered by a different one
4. Tokens with broader scope than this workflow needs

For each finding, show the safe rewrite. If you find nothing, say so in one line rather than inventing issues.

File:
[PASTE]

Find where untrusted input reaches execution

The single most useful audit question. Both major 2026 incidents were this, not anything exotic.

Trace every path in this code where data from outside the system reaches something that executes. Shell commands, eval, template rendering, SQL, deserialisation, file paths.

For each path, tell me:
- Where the data enters
- What transforms it along the way
- Whether any transform actually neutralises it, or just looks like it does
- What an attacker controls at each step

Do not list general best practices. Only trace what is here.

Code:
[PASTE]

Check what an endpoint actually verifies

Written after a CVE where an endpoint that runs code was guarded by whether a header started with a particular string.

For each endpoint in the code below, tell me:

1. What it verifies before acting
2. Whether that check can be forged by the caller
3. What it can do if the check passes
4. Whether the blast radius matches the strength of the check

Flag anything where a weak or spoofable check guards a strong capability.

Code:
[PASTE]

Test a summariser against hidden text

Forcepoint showed a 537-character visible email delivering 1,009 characters to the model, and every test run produced a manipulated summary.

I want to check whether this summarisation flow can be manipulated by content the user cannot see.

Tell me:
- What the model receives versus what a person would see rendered
- Whether zero-size text, matching-colour text, hidden HTML or metadata reach the model
- Where I should strip content so only user-visible text is passed
- How I would detect that a summary had been manipulated after the fact

Flow description:
[PASTE]

Review connector and token scope

Reducing connector scope shrinks the impact of every future flaw in this class, not just the one you know about.

List every external integration and credential this system holds.

For each: what it can read, what it can write, what would happen if an attacker controlled a prompt while it was connected, and whether the scope is wider than the feature requires.

Rank by blast radius, not by how likely you think compromise is.

System description:
[PASTE]

Write the test that would have caught it

Turns an incident into a control. The class matters more than the instance.

Here is a vulnerability that was found in my system: [DESCRIBE]

Write the test that would have caught it before it shipped. Then tell me:
- What class of bug this belongs to
- Where else in a typical codebase that class hides
- What check I should add to CI so this category cannot recur

I want a permanent gate, not a one-time fix.