NOTE · 22 SEP 2026
The standards behind AI code security: OWASP, NIST SSDF, the CRA, SBOM and MCP
ANSWER FIRST
Five public documents shape what AI code security tools do: OWASP's Top 10 for LLM applications, which puts prompt injection first; NIST's Secure Software Development Framework; the EU Cyber Resilience Act, whose reporting duties apply from 11 September 2026; CISA's work on SBOMs; and the Model Context Protocol specification. None of them names a product, but each explains features buyers now see on vendor pages.
Editorial assessment · Compiled from vendor product, docs, pricing and marketplace pages · Rated October 2026
By Best AI Code Security reviewers · Published 22 September 2026
Vendor pages describe features; standards explain why those features exist. This note takes the five documents we cite most on this site, says what each one asks for, and maps it to the controls and scoring criteria used here. It is a summary for buyers, not legal advice, and each section links to the primary source.
OWASP Top 10 for LLM Applications: prompt injection first
OWASP's Top 10 for Large Language Model Applications lists prompt injection first, as LLM01:2025. For coding agents, prompt injection means instructions hidden in content the agent reads, such as code comments, issues or dependency files, that try to change what it does. Legit VibeGuard lists detection of prompt injection and malicious instructions hidden in comments or dependencies among its capabilities. The related controls sit in our coding agent guardrails criterion.
Source: OWASP: LLM01:2025 Prompt Injection · Reviewed Sep 2026
Source: Legit Security: VibeGuard · Reviewed Sep 2026
NIST SSDF (SP 800-218): the practice baseline
The Secure Software Development Framework, NIST SP 800-218, is a set of secure software development practices in four groups: Prepare the Organization, Protect the Software, Produce Well-Secured Software, and Respond to Vulnerabilities. NIST SP 800-218A adds a community profile for generative AI and dual-use foundation models. Buyers use the SSDF to ask suppliers how they build software. For teams using coding agents, the practical question is how agent-written changes pass through the same review, testing and vulnerability response as any other change.
Source: NIST CSRC: Secure Software Development Framework · Reviewed Sep 2026
EU Cyber Resilience Act: reporting from 11 September 2026
From 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents that affect product security through the CRA Single Reporting Platform: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report later. Open-source software stewards face the same reporting obligations from 11 December 2027. The duty attaches to the product, whoever or whatever wrote its code, so knowing quickly which products contain an affected component matters. Our lesson on the CRA and SSDF has the full timeline.
Source: European Commission: CRA reporting obligations · Reviewed Sep 2026
SBOM: the inventory behind a fast answer
CISA describes a software bill of materials as a nested inventory, a list of ingredients that make up software components. An SBOM is what lets a team answer 'are we affected?' inside a 24-hour reporting window. Some vendors extend the idea to AI components: an AI-BOM lists models, AI packages, assistant rule files, MCP servers and AI API keys. Cycode tracks these with commit provenance, and OX Security publishes SBOM drift detection. This sits in our secrets and supply chain criterion.
Source: CISA: Software Bill of Materials · Reviewed Sep 2026
Source: Cycode: AI security · Reviewed Sep 2026
Source: OX Security · Reviewed Sep 2026
Model Context Protocol: the specification agents connect through
The Model Context Protocol is the open protocol coding assistants use to connect to external tools and data through MCP servers. The current version of the specification is dated 2026-07-28; in it, each request declares its protocol version, and a server/discover call returns a server's supported versions and capabilities. MCP is not a security standard, but its design decides what security tools can see: discovery of MCP servers, approval lists and filtering of tool calls now appear on several vendor pages. Our lesson on MCP server security covers the steps.
Source: Model Context Protocol: versioning · Reviewed Sep 2026
How do the five map to tool features?
| Document | Publisher | What it covers | Related criterion on this site |
|---|---|---|---|
| Top 10 for LLM Applications (LLM01:2025) | OWASP | Prompt injection as the first risk for LLM applications | Coding agent guardrails |
| SSDF, SP 800-218 and SP 800-218A | NIST | Secure development practices in four groups, plus a generative AI profile | AI-generated code coverage; secrets and supply chain |
| Cyber Resilience Act reporting | European Commission | Reporting of exploited vulnerabilities and severe incidents within 24 and 72 hours | Secrets and supply chain; prioritization and context |
| Software Bill of Materials | CISA | An inventory of the components in software | Secrets and supply chain |
| MCP specification 2026-07-28 | Model Context Protocol | Versioned requests and server discovery | Coding agent guardrails |
What should a buyer ask?
- Which of these documents does the vendor map its features to, and where is that mapping published?
- Can the tool produce an SBOM, and an inventory of AI components, for a given product and date?
- How quickly can the tool show which products contain a component named in a new advisory?
- How does the tool detect instructions hidden in files the agent reads?
- Which MCP servers can it discover, and can it block one?
Sources
- OWASP: LLM01:2025 Prompt Injection genai.owasp.org
- NIST CSRC: Secure Software Development Framework csrc.nist.gov
- European Commission: CRA reporting obligations digital-strategy.ec.europa.eu
- CISA: Software Bill of Materials cisa.gov
- Model Context Protocol: versioning modelcontextprotocol.io
- Legit Security: VibeGuard legitsecurity.com
- Cycode: AI security cycode.com
- OX Security ox.security