Secure AI-Assisted Software Engineering: A Technical Survey of Prompt Injection Defense, Tool-Use Security, and Agentic SDLC Hardening

Scope: This work will produce a state-of-the-art technical survey and practitioner playbook on securing AI-assisted coding and automation systems against prompt injection and adjacent risks. It will cover direct and indirect prompt injection, tool-output injection, retrieval poisoning, memory/context contamination, jailbreak-driven tool misuse, and cross-tool/plugin attack chains in environments where LLMs interact with repositories, terminals, APIs, browsers, CI/CD pipelines, cloud systems, databases, email, MCP servers, and skills/plugins. The survey will explicitly analyze how risk changes across capability stages, from autocomplete assistants to production automation agents, and will map each stage to required controls and human-approval boundaries. Technical depth and constraints: The work will prioritize sources and practices from 2023–2026, emphasizing high-quality primary references (standards, vendor documentation, peer-reviewed papers, and reputable security research). It will not treat guardrails or prompting as sufficient security mechanisms. Instead, it will enforce explicit trust-boundary reasoning, least-privilege design, capability scoping, sandboxing, policy-as-code, provenance-aware retrieval, taint-aware tool orchestration, and auditable approval gates. It will distinguish what is production-ready versus experimental, and identify controls that are useful but insufficient in isolation. Deliverables and structure: The output will follow a 22-part structure including executive summary, threat model, attack and defense taxonomies, environment-specific risk analysis (Codex-style agents, Claude Code, Cursor, Copilot-class tools, MCP-enabled systems), RAG/document-processing security, secure reference architecture, tooling survey, secure SDLC pipeline for AI-generated PRs, offline audit methodology, runtime protection methodology, red-team methodology, mitigation matrix, practical configuration examples, checklists, implementation roadmap, maturity model, common fallacies, limitations, and references. It will include concrete attack payload examples, expected safe behavior, and regression-testing patterns. Success criteria: The survey is successful if teams can directly adapt its controls into repository policy, CI/CD gates, and runtime agent governance with minimal translation work. It must provide actionable mappings from attack vectors to preventive/detective/containment/recovery controls, plus explicit residual-risk statements. It must also include role-appropriate adoption guidance for solo developers, startups, research labs, enterprises, and regulated environments. Expected artifacts: (1) comprehensive survey manuscript, (2) mitigation matrix, (3) red-team prompt/eval suite design, (4) secure workflow and policy templates, (5) CI/CD reference checklist for AI-generated changes, and (6) architecture diagrams/tables suitable for implementation planning.