Prompting an AI for secure code: say what must be true, then verify

To get safer code from an AI assistant, say which inputs are untrusted, name the property you need (for example parameterized queries, or an authorization check per record), ask it to explain how the code meets that property, and then verify with tests and review. The prompt shapes the draft, and the checks decide whether it is safe.

Be specific about the threat

Anthropic's guidance says the model responds well to clear, explicit instructions and that it behaves like a capable new employee who lacks your context. If you do not say that a parameter comes from a request, the assistant may treat it as trusted.

Compare two prompts.

Weak:   Write a function that looks up an invoice by id.
Better: Write a function that looks up an invoice by id. The id comes from an HTTP request and is untrusted.
        Use a parameterized query. Return the invoice only if it belongs to the authenticated user.
        Return not found, with no detail, otherwise.

The second prompt names the source, the technique, and the authorization rule, which are the usual gaps.

Constraints worth stating

• Where input comes from and what is trusted.
• The mechanism you require, such as parameterized queries, context aware output encoding, or a standard library function for parsing.
• What not to use, such as string building for queries or shell commands, or homemade crypto.
• Dependency policy: prefer the standard library, add no new packages without saying so. See how to check an AI-suggested package.
• Error behavior: no internal details to the caller, no secrets in logs.

Ask for the reasoning

After the code, ask: "List each place untrusted input is used and how it is handled." This gives you a map to check against, and a gap in the map is often a gap in the code.

Then verify

A prompt is a request, and models do not always follow it.

1. Tests that try to break the rule. Another user's invoice id, an id with quotes, an oversized input.
2. Static analysis in CI, as a second opinion from a different kind of tool.
3. Review. Read the diff as if a stranger wrote it. Authorization and input sinks first.
4. Dependency check for anything new.

OWASP's guidance on improper output handling is a good lens for generated code that handles model output: treat it as untrusted, use parameterized queries, and encode for the context.

Do not trust the confidence

The Stanford user study found that participants with an AI assistant were more likely to believe their code was secure while writing less secure code. Do not let a clean explanation substitute for a failing test. See what the studies show.

Keep a reusable snippet

Save your security constraints as a short block your team pastes into every coding prompt, or put them in whichever project instruction file your assistant supports. Update it when a review finds a recurring miss.

Quick check

Sources

• Prompting best practices (Anthropic)
• LLM05:2025 Improper Output Handling (OWASP GenAI)
• Do Users Write More Insecure Code with AI Assistants? (arXiv)

Last reviewed: 19 October 2026.