OWASP Releases a Practical Guide to Testing AI Systems
The new manual covers models, connected applications and AI agents, with eight phases from planning to remediation.
OWASP's GenAI Security Project published a new AI testing manual on 20 October 2026, giving teams a structured way to examine what happens when a model is connected to an application, tools and data. The version 1.0 release covers generative AI systems, including agents and interfaces that accept more than text.
For Thai developers putting an AI feature into a customer service tool or internal workflow, the useful starting point is the system around the model: what information it can read, which actions it can take, and who is responsible when a test fails.
A test plan before a release
The manual organises testing into eight phases. Teams begin by defining the scope, map the system and its exposed surfaces, investigate weaknesses, then assess their consequences. Reporting and remediation complete the process.
Its scope includes retrieval, external tools, identity and authorisation. A convincing answer in a demonstration cannot establish whether those connections respect the intended boundaries. A builder needs to examine the application with the permissions and data it will have in use.
The guide also addresses repeatability. A useful report should let another team understand what was tested and reproduce the result. That makes the work easier to revisit after a model, prompt, permission or application update. Tests should stay within an agreed, authorised scope.
For a business commissioning a review, a practical first conversation is about the decision the review must support. Is the team assessing a launch, a new data connection or a change to an existing service? Naming that decision helps keep a broad security exercise tied to the actual product.
Agents need visible boundaries
OWASP's separate Agent Control Standard, dated 1 September 2026, describes a way to make agent behaviour observable and apply portable policies while the system runs.
Testing and runtime controls address different jobs. Testing investigates how a system behaves under specified conditions. Runtime controls govern what it is allowed to do during use. A team considering either document should identify the data and actions involved before deciding which controls to implement.
Our reading of the two resources is that an AI application review needs a named owner for its connections. Someone must be able to explain why a tool is available, what permission it has, and how the team would detect an unexpected action. Those are product questions as well as engineering questions.
The Thai-language testing question
Thailand's Electronic Transactions Development Agency, ETDA, described a related local challenge in a 5 October announcement. Its plans for 2027 include an AI Governance Sandbox and work with Singapore on Thai-language test prompts that reflect local language, culture and safety concerns.
Those are announced plans. The release does not establish that applications to a new sandbox are open or that a particular company's product has been approved.
The relevance for a Thai builder is practical: English-language testing alone leaves a question about the language customers will use. Teams can make that question explicit in their review brief, then record which language and user context each test covers.
The next documents to watch are ETDA's published participation details and test resources. For work starting now, OWASP's manual is available from its resource page, with version and licence information in the PDF.
FAQ
Is the OWASP manual a certification?
It is testing guidance. Reading or applying it does not by itself certify a product or show that it meets every legal requirement.
Is it only about chatbots?
No. The stated scope includes models, applications, multimodal interfaces and AI agents, including their connected tools and data.
Has ETDA opened the planned 2027 sandbox?
The source reviewed describes plans announced on 5 October 2026. It does not provide evidence of an open application round.
