An AI-enabled native application is not just a prompt box in a different window. It may store conversations on disk, register URL handlers, call local services, load plugins, update itself and connect directly to model providers. Those boundaries belong in the security test.
Test rule. Follow a request from the native interface through local state, backend APIs and model providers to every action the response can trigger.
Map the native request path
Trace how a prompt, file or voice input moves through the client. Identify local preprocessing, telemetry, proxy behavior, backend calls, model routing and response handling. Record which paths differ from the web product and which decisions rely on the device.
The map should show where identity is established, which secrets the application needs, how configuration arrives and whether the client can perform privileged local or remote actions.
Local storage and secrets
Review conversation caches, retrieval indexes, downloaded files, logs, crash reports, tokens and provider keys. Sensitive values should use platform-provided secure storage; exported backups, shared containers and permissive filesystem modes should not expose them.
Check deletion semantics as well. Removing a conversation from the interface may leave cached content, local embeddings, diagnostics or synchronized copies behind.
Deep links, URL handlers and IPC
Custom URL schemes, universal links and desktop protocol handlers can pass attacker-controlled content into a trusted client. Test argument parsing, origin confirmation, navigation, file opening and whether a link can trigger an action without sufficient user context.
Desktop applications often communicate with helpers, browser extensions or local proxy services. Review local ports, named pipes, sockets and message channels for authentication, authorization and unsafe deserialization. A local-only service is still reachable by other processes running as the user.
Updates, plugins and distribution trust
Verify package signatures, update metadata, transport protection, rollback behavior and the boundary between a signed core and dynamically loaded content. Plugins and extensions need independent permission and update models; a trusted client should not silently grant an untrusted plugin access to conversations or tools.
For enterprise deployments, include device management, certificates, local proxies and configuration profiles that change the application’s network or trust behavior.
Mobile-specific coverage
For iOS and Android, include platform permissions, exported components, clipboard handling, screenshots, notification previews, app links, WebViews and biometric or device-bound assumptions. Test the backend API independently because client-side restrictions are not authorization controls.
Where the application uploads photos, documents or audio, review metadata, parsers, file access and the lifetime of temporary artifacts.
Desktop-specific coverage
For macOS and Windows, include filesystem reach, drag-and-drop, shell integrations, clipboard access, application-support directories, auto-start services and inter-process boundaries. If the client captures or routes traffic, test certificate trust, system proxy behavior and recovery after a partial install or removal.
An AI coding client may also read repositories, invoke commands or integrate with an IDE. Those capabilities create tool-authorization questions even when the product is not described as an autonomous agent.
Model and agent behavior still matters
Native coverage complements adversarial model testing; it does not replace it. Test prompt and retrieval boundaries, provider changes, tool calls, memory, content rendering and whether malicious model output can exploit the client through unsafe markdown, links, file paths or command suggestions.
Evidence and retest
Record the platform, build, architecture and configuration tested. Native findings are sensitive to versions and deployment state. A retest should use the fixed build and confirm both the original path and nearby platform variants.
Need a native application reviewed?
Send the client platforms, connected APIs and target date.
Request an assessment