AI Security
OWASP reference
This page maps the design of the NeoSpline agent to two security lists from OWASP, a nonprofit whose guidance security teams widely use. Both are 2026 editions: one for applications built on large language models (LLMs), the AI models behind tools such as ChatGPT, and one for agentic applications, where an AI agent takes actions.
In the last column, "Follows" means the code does what the OWASP guidance asks. "Avoids the risk by design" means NeoSpline's design leaves no path for the risk to occur.
On request, we share more detail and our security documents under a non-disclosure agreement (NDA).
Request Security DocumentsOWASP Top 10 for LLM Applications 2026
The full list: OWASP Top 10 for LLM Applications 2026 (opens in a new tab).
| OWASP item (2026 edition, page) | What OWASP asks | What NeoSpline does | Status |
|---|---|---|---|
| LLM01:2026 Prompt Injection, p. 13 | Make the defense architectural: constrain what the model is permitted to do. | The fixed set of operations limits what a fooled agent can do. Filters that try to detect attacks, and our tests, are extra layers on top. | Follows |
| LLM01:2026 Prompt Injection, p. 13 | Remove one of three conditions: access to private data, exposure to untrusted content, or a way to communicate externally. | The agent has no way to communicate externally. | Follows |
| LLM03:2026 Excessive Agency, pp. 24–25, items 1 and 2 | Limit the tools and their functions to the minimum necessary. | The agent has a small, fixed set of tools. The tools can use only a fixed set of operations, and only on the open document. | Follows |
| LLM03:2026 Excessive Agency, p. 25, item 3 | Avoid open-ended tools; give every tool a strict input schema. | No command-line (shell), web, or file operation exists. The server checks every argument against a strict schema. | Follows |
| LLM03:2026 Excessive Agency, p. 25, item 6 | Require human approval for high-impact actions. | By default, you approve each batch of changes before it runs. | Follows |
| LLM03:2026 Excessive Agency, p. 25, item 7 | Enforce permissions in code, not in the AI model. | Server code, not the AI, enforces approval and Consult mode (in which the agent can look at the model but not change it). | Follows |
| LLM06:2026 Unbounded Consumption, p. 40, items 1–2; p. 41, item 9 | Set rate limits, quotas, and spending caps, and limit the steps, recursion, time, and cost of each run. | Hard limits on steps, tool calls, time, memory, message rate, and credits. A script cannot start another script. | Follows |
| LLM10:2026 Improper Output Handling, p. 55, common example 1; p. 56, item 1 | Never pass model output to a shell, exec, or eval; validate model output like user input. | The model's output is a script that the server checks against a strict schema. NeoSpline has no shell, no Python exec or eval, no C# compiled at runtime, and no call to RhinoApp.RunScript or RhinoApp.ExecuteCommand. | Follows |
OWASP Top 10 for Agentic Applications 2026
The full list: OWASP Top 10 for Agentic Applications 2026 (opens in a new tab).
| OWASP item (2026 edition, page) | What OWASP asks | What NeoSpline does | Status |
|---|---|---|---|
| ASI01: Agent Goal Hijack, p. 10, item 1 | Treat all natural-language input as untrusted. | Names from your document reach the AI as quoted data, and the AI's standing instructions (system prompt) tell it how to treat text from the document. | Follows |
| ASI01: Agent Goal Hijack, p. 10, item 2 | Require human approval for high-impact actions. | By default, you approve each batch of changes before it runs. The server enforces this. | Follows |
| ASI02: Tool Misuse and Exploitation, p. 13, item 1 | Restrict each tool's functions, permissions, and data scope. | No file, network, or process operation exists. The agent works only on the open document. | Follows |
| ASI02: Tool Misuse and Exploitation, p. 14, item 3 | Allow only listed network destinations; block all others. | The agent has no network access at all. | Follows |
| ASI02: Tool Misuse and Exploitation, p. 14, item 4 | Check every tool argument against a schema, and enforce rate limits. | The server checks every operation and argument against a strict schema. | Follows |
| ASI02: Tool Misuse and Exploitation, p. 14, item 5 | Set limits on cost, request rate, or tokens (units of AI text). | Credit checks before each run and message-rate limits stop or slow the agent. | Follows |
| ASI05: Unexpected Code Execution (RCE), p. 21; p. 22, item 3 | Sandbox generated code; ban eval. | No AI-written general-purpose code runs. The NeoSpline script language has no eval, and the plugin never calls RhinoApp.RunScript or RhinoApp.ExecuteCommand. | Avoids the risk by design |