AI Systems Security

Security guidance for teams that serve, integrate, or operate LLMs and AI agents — not for teams training or fine-tuning models. Covers the attack surface introduced when products call LLM APIs, run agent workflows, or expose tool servers.

When to Use

• Integrating an LLM API (OpenAI, Anthropic, self-hosted) into a product
• Deploying model-serving infrastructure (OpenShift AI, RHOAI, vLLM)
• Building or reviewing agent workflows that take actions on behalf of users
• Connecting MCP servers to agents or LLM-powered features
• Reviewing AI system architecture for security gaps

When NOT to Use

• Reviewing AI-generated code for correctness (use ai-code-review)
• General web application security without AI components (use web-application-security)
• Container hardening without AI-specific concerns (use container-hardening)