Tools for AI engineering and security
> Practical work on how AI is built, understood, and used. Explore tools developed at Aelion Path alongside open-source OWASP projects Helen Oakley co-leads.
Aelion Path · Open-source tool
AI SDLC Harness
AI Software Development Life Cycle (SDLC) Harness gives developers a structured way to direct and review work performed with AI coding agents. Here, “harness” means the workflow structure around the agent’s work: defining the task, guiding its progress, and recording what was checked. It keeps scope, acceptance criteria, and evidence alongside the code in the project repository, with developers retaining authority over key decisions and final acceptance.
OWASP tools for AI transparency and security
Helen Oakley created OWASP AIBOM Generator and OWASP FinBot CTF, turning practical challenges in AI transparency and agentic security into open-source tools. Both continue to evolve under her leadership with contributions from the OWASP community, under the OWASP GenAI Security Project. She also contributes to the OWASP Agent Control Standard (ACS), focusing on AgentBOM.
OWASP AIBOM Generator
Make AI model information easier to inspect.
OWASP AIBOM Generator creates AI Bills of Materials from model information on Hugging Face. It organizes available metadata into a CycloneDX document and highlights gaps through completeness scoring.
For security, engineering, and AI teams, this provides a practical starting point for examining model provenance, documentation, and supply chain transparency.
- Gather metadata from model cards, configurations, and repository files.
- Review a readable AIBOM and download its JSON representation.
- Identify missing information for further investigation.
OWASP FinBot CTF
Explore agentic AI security through hands-on learning.
OWASP FinBot CTF is an intentionally vulnerable application for learning how agentic AI systems can fail. Its vendor-management scenario gives participants a realistic setting for exploring interactions between AI agents, tools, business rules, and sensitive information.
Capture-the-flag challenges turn those interactions into practical learning for security practitioners, developers, and educators.
- Explore prompt injection, tool misuse, and policy bypass in a purpose-built learning environment.
- Investigate how agent behavior affects business processes and data.
- Work through challenges connected to OWASP security guidance.
AgentBOM · OWASP ACS
Making agent composition and dependencies visible.
The OWASP Agent Control Standard (ACS) is an evolving open standard for inspecting, tracing, and controlling AI agents. Helen leads its AgentBOM (AgBOM) work, focused on describing the components and dependencies that shape an agent’s operation.
An Agent Bill of Materials provides a structured view of the tools, models, and dependencies an agent uses—including changes as it operates.
- Make agent components and dependencies visible.
- Track how agent composition changes at runtime.
- Provide context for security analysis and control decisions.