06 AI Security Threat Landscape

AI systems are becoming part of critical enterprise environments.

Organizations are using AI to:

• Process sensitive data
• Support security operations
• Automate business workflows
• Assist developers
• Search enterprise knowledge
• Interact with cloud platforms
• Support customers
• Generate decisions and recommendations
• Power autonomous agents

As AI adoption grows, attackers gain new opportunities.

The AI security threat landscape includes both:

• Traditional cybersecurity threats
• AI-specific threats

An AI Security Engineer must understand both.

The key question is no longer only:

How can an attacker compromise our infrastructure?

It is also:

How can an attacker manipulate, misuse or abuse the AI system itself?

Learning Objectives

By the end of this lesson, you should be able to:

• Understand the modern AI security threat landscape.
• Identify common AI threat actors.
• Understand attacker motivations.
• Recognize AI-specific attack categories.
• Understand traditional attacks against AI infrastructure.
• Recognize prompt-based threats.
• Understand model and data security threats.
• Recognize RAG and AI agent threats.
• Understand AI supply-chain risks.
• Recognize AI-enabled cyberattacks.
• Understand insider and third-party risks.
• Evaluate AI threats based on likelihood and impact.
• Apply threat thinking to an enterprise AI environment.

What Is the AI Security Threat Landscape?

The AI Security Threat Landscape describes the threats, attackers, attack techniques and risks that may affect AI systems.

A simplified view is:

Threat Actor
     ↓
Motivation
     ↓
Attack Surface
     ↓
Attack Technique
     ↓
Security Impact

For example:

Malicious Insider
      ↓
Data Theft
      ↓
Enterprise AI Assistant
      ↓
Authorization Abuse
      ↓
Confidential Data Exposure

Understanding the complete chain helps security teams prioritize defenses.

AI Threats Are Not Only About LLMs

A common mistake is thinking AI threats only involve:

• Prompt injection

• Jailbreaking

• Chatbots

The real threat landscape is much broader.

AI systems depend on:

Users
+
Applications
+
APIs
+
Models
+
Data
+
RAG
+
Agents
+
Cloud
+
Containers
+
CI/CD
+
MLOps
+
Third-Party Services

Attackers can target any of these layers.

Traditional Threats Still Apply

AI systems can still be attacked using traditional techniques.

Examples include:

• Credential theft

• Phishing

• Malware

• Cloud misconfiguration

• API exploitation

• Broken access control

• Vulnerable software

• Supply-chain compromise

• Privilege escalation

• Insider abuse

AI-specific threats are added on top of these.

AI-Specific Threats

AI introduces new attack possibilities such as:

• Prompt injection

• Indirect prompt injection

• Model manipulation

• Data poisoning

• RAG poisoning

• Model extraction

• AI agent abuse

• Tool manipulation

• Model evasion

• Unsafe generated output

• Excessive agency

The result is a combined threat landscape.

Traditional Cyber Threats
          +
AI-Specific Threats
          =
Enterprise AI Threat Landscape

Threat Actors

A threat actor is an individual or group that may attempt to compromise or misuse a system.

Different threat actors have different motivations and capabilities.

1 — Cybercriminals

Cybercriminals typically attack systems for financial gain.

Possible motivations include:

• Data theft

• Extortion

• Fraud

• Ransomware

• Credential theft

• Selling access

• Resource abuse

AI systems may become attractive targets because they can provide access to:

• Sensitive business data

• Customer information

• Expensive computing resources

• High-value APIs

• Enterprise systems

Example

Cybercriminal
      ↓
Compromised AI Application Credential
      ↓
Enterprise AI Platform
      ↓
Sensitive Data Access
      ↓
Extortion / Sale

2 — Nation-State Actors

Nation-state attackers may target organizations for:

• Espionage

• Intelligence collection

• Strategic advantage

• Technology theft

• Disruption

AI environments may contain valuable:

• Models

• Research

• Proprietary datasets

• Source code

• Intellectual property

Advanced attackers may target the AI supply chain rather than only the final application.

3 — Malicious Insiders

Insiders may already have legitimate access.

Examples include:

• Employees

• Contractors

• Administrators

• Developers

• Partners

An insider may abuse:

• AI applications

• RAG systems

• Administrative access

• Model repositories

• Training data

• Logs

Example:

Employee
   │
   ▼
Enterprise AI Assistant
   │
   ▼
Queries Sensitive Data
   │
   ▼
Copies Information

Strong authorization and monitoring remain essential.

4 — Curious or Accidental Users

Not every security incident is malicious.

A user may accidentally:

• Upload confidential information

• Send secrets to an external AI service

• Share customer data

• Expose source code

• Generate unsafe configurations

This is particularly relevant to Shadow AI.

Security must consider both malicious and accidental behavior.

5 — Security Researchers

Security researchers may investigate AI systems to identify vulnerabilities.

Legitimate research is valuable when performed:

• With authorization

• Within defined scope

• Under bug bounty rules

• Through responsible disclosure

Unauthorized testing can still create risk regardless of intent.

6 — Competitors

Organizations may face attempts to steal:

• Proprietary models

• Training methods

• Datasets

• AI workflows

• Prompt architecture

AI models and datasets can represent valuable intellectual property.

7 — Supply-Chain Attackers

Supply-chain attackers target dependencies used by AI systems.

Possible targets include:

• Python packages

• Containers

• AI models

• Model repositories

• Development tools

• Libraries

• CI/CD platforms

Example:

Attacker
   ↓
Compromised Dependency
   ↓
AI Development Pipeline
   ↓
Production Application

The organization may be compromised without the attacker directly attacking the production AI system.

8 — Third-Party Service Compromise

Organizations depend on external services.

Examples include:

• AI APIs

• Cloud platforms

• Model repositories

• SaaS AI tools

• Data services

If a third party is compromised, the organization’s AI environment may also be affected.

Attacker Motivations

Attackers may target AI systems for different reasons.

Financial Gain

Examples:

• Fraud

• Ransom

• Resource theft

• Data resale

Data Theft

Attackers may target:

• Customer records

• Employee data

• Intellectual property

• Credentials

• Source code

Model Theft

An attacker may attempt to obtain:

• Model files

• Model parameters

• Proprietary fine-tuned models

• Model behavior

Espionage

AI research, proprietary models and datasets may have significant strategic value.

Disruption

Attackers may attempt to:

• Make AI unavailable

• Exhaust API quotas

• Manipulate AI decisions

• Degrade model performance

Manipulation

An attacker may want the AI to:

• Produce incorrect information

• Perform unauthorized actions

• Reveal confidential data

• Make unsafe decisions

Reputation Damage

If an organization deploys an AI system that produces harmful or incorrect behavior, attackers may attempt to exploit this publicly.

Major AI Threat Categories

Now let’s examine the major categories an AI Security Engineer should understand.

1 — Prompt Injection

Prompt injection occurs when attacker-controlled input attempts to manipulate an AI system’s instructions.

Conceptually:

Trusted Instructions
       +
Malicious User Input
       ↓
      LLM
       ↓
Unexpected Behavior

Possible outcomes include:

• Bypassing intended restrictions

• Revealing information

• Manipulating application behavior

• Influencing agent actions

Prompt injection becomes more dangerous when the model is connected to sensitive tools or data.

2 — Indirect Prompt Injection

Indirect prompt injection occurs when malicious instructions enter through external content.

Examples include:

• Documents

• Websites

• Emails

• Database records

• Search results

Example:

Malicious Document
      ↓
RAG System
      ↓
LLM Context
      ↓
AI Processes Hidden Instruction

The user may not even know the malicious instruction exists.

This creates a major enterprise risk for systems that automatically consume external content.

3 — Jailbreaking

Jailbreaking attempts to bypass restrictions placed on a model.

The attack may involve:

• Role manipulation

• Obfuscation

• Multi-step instructions

• Context manipulation

Security engineers should focus on:

What security impact results if the restriction is bypassed?

The goal is not simply to demonstrate unusual output.

4 — Sensitive Information Disclosure

AI systems may expose sensitive data through:

• Responses

• RAG retrieval

• Logs

• Conversation memory

• Error messages

• Agent tools

Sensitive information may include:

• Customer records

• Credentials

• Internal policies

• Source code

• Security architecture

Example:

Unauthorized User
      ↓
AI Assistant
      ↓
RAG
      ↓
Confidential Document

This may be an authorization problem more than a model problem.

5 — Data Poisoning

Attackers may attempt to manipulate data used by the AI system.

Possible targets include:

• Training datasets

• Fine-tuning data

• RAG documents

• Evaluation datasets

Conceptually:

Trusted Dataset
      +
Malicious Data
      ↓
Training / Retrieval
      ↓
Manipulated Behavior

Data poisoning attacks the integrity of the AI system.

6 — RAG Poisoning

RAG systems can be targeted by manipulating the knowledge they retrieve.

Example:

Attacker Adds Malicious Document
          ↓
Document Indexed
          ↓
RAG Retrieves It
          ↓
LLM Uses Malicious Content

Potential outcomes include:

• Incorrect responses

• Indirect prompt injection

• Manipulated recommendations

• Unsafe actions

Document provenance and ingestion security therefore matter.

7 — Model Theft

Models may contain significant intellectual property.

Attackers may attempt:

• Model file theft

• Unauthorized downloads

• Model extraction through APIs

• Credential theft

Organizations should protect model repositories and access.

8 — Model Tampering

An attacker may modify a model.

Example:

Model Repository
      ↓
Attacker Gains Access
      ↓
Model Replaced
      ↓
Production Deploys Modified Model

This is an integrity attack.

Model signing, version control and deployment controls can help reduce risk.

9 — Model Backdoors

A malicious or compromised model may behave normally most of the time but produce manipulated behavior when specific conditions appear.

Conceptually:

Normal Input
    ↓
Normal Behavior

Trigger Input
    ↓
Unexpected Malicious Behavior

This makes supply-chain validation important.

10 — Model Evasion

Attackers may intentionally craft inputs that cause a model to make incorrect decisions.

This is especially relevant to classification systems.

Example:

Malicious Input
      ↓
Modified Slightly
      ↓
Security Model
      ↓
Classified as Benign

This may affect:

• Malware detection

• Fraud detection

• Image recognition

• Threat detection

11 — Model Extraction

Attackers may query a model repeatedly to learn its behavior or approximate its functionality.

Potential objectives include:

• Replicating proprietary models

• Understanding decision boundaries

• Avoiding detection

Controls may include:

• Rate limiting

• Access restrictions

• Monitoring

• Usage analysis

12 — Membership or Data Inference

Attackers may try to determine whether certain information was part of a model’s training or infer sensitive information.

This creates privacy and confidentiality concerns.

Sensitive training datasets deserve strong protection.

13 — Insecure Output Handling

An AI model may generate content that another system processes.

Examples include:

• SQL

• HTML

• Code

• Shell commands

• API calls

Example:

LLM
 ↓
Generated Command
 ↓
Application Executes Automatically

If output is not validated, AI-generated content can become an attack path.

14 — AI Agent Abuse

AI agents are particularly important because they can perform actions.

An agent may access:

Email
Cloud
Databases
Files
Security Tools
Business Systems

If manipulated, an attacker may be able to turn model behavior into real-world actions.

15 — Excessive Agency

An agent may have more authority than necessary.

Example:

Required:
Read Security Logs

Granted:
Full Cloud Administrator

If the agent is compromised or manipulated, impact becomes much larger.

Least privilege is critical.

16 — Tool Manipulation

AI agents depend on tools.

Attackers may attempt to:

• Influence which tool is selected

• Manipulate tool arguments

• Abuse tool permissions

• Inject malicious tool output

Example:

Untrusted Input
     ↓
AI Agent
     ↓
Cloud Tool
     ↓
Unauthorized Action

Tool authorization should not depend only on the model’s decision.

17 — Agent Memory Manipulation

Some agents maintain memory across interactions.

Potential concerns include:

• Malicious memory entries

• Persistent manipulation

• Sensitive information retention

• Cross-user data leakage

Agent memory becomes another trusted data source that must be secured.

18 — Multi-Agent Threats

Some systems use multiple AI agents.

Example:

User
 │
 ▼
Coordinator Agent
   │
   ├── Research Agent
   ├── Security Agent
   └── Execution Agent

Security questions include:

• Can one agent influence another?

• How are permissions separated?

• Is agent-to-agent communication trusted?

• Which agent can perform sensitive actions?

Multi-agent environments create additional complexity.

19 — Unauthorized API Access

AI applications rely heavily on APIs.

Attackers may target:

• Exposed API keys

• Weak authentication

• Broken authorization

• Excessive permissions

This is a traditional API threat with potentially significant AI impact.

20 — API Cost Abuse

AI APIs often have usage-based pricing.

An attacker may intentionally generate large numbers of requests.

Potential impact:

High Request Volume
      ↓
High Token Usage
      ↓
Unexpected Cost

Financial impact becomes part of availability and abuse prevention.

21 — Resource Exhaustion

AI workloads can be expensive.

Attackers may target:

• GPUs

• CPU

• Memory

• Model endpoints

• API quotas

Availability controls remain important.

22 — Credential Theft

Credentials used by AI systems may provide access to:

• LLM APIs

• Cloud resources

• Databases

• Model repositories

• RAG data

Credentials may be exposed through:

• Source code

• Logs

• Environment variables

• Developer workstations

Traditional secret management remains critical.

23 — Cloud Infrastructure Compromise

AI workloads frequently run in cloud environments.

Attackers may target:

• IAM

• Storage

• Virtual machines

• Containers

• Kubernetes

• Serverless functions

A cloud compromise may expose the complete AI platform.

24 — Container and Kubernetes Attacks

AI workloads may rely on containers.

Potential threats include:

• Vulnerable images

• Compromised workloads

• Excessive container privileges

• Kubernetes API compromise

• Secret theft

AI security and container security increasingly overlap.

25 — CI/CD Compromise

Attackers may target deployment pipelines.

Example:

Developer Repository
       ↓
CI/CD
       ↓
Container
       ↓
AI Application

If the pipeline is compromised, an attacker may inject malicious code into the AI application before deployment.

26 — MLOps Pipeline Compromise

MLOps pipelines may control:

• Dataset preparation

• Training

• Validation

• Model registration

• Deployment

Attackers may target any stage.

Dataset
   ↓
Training
   ↓
Model Registry
   ↓
Deployment

Compromise upstream can affect production downstream.

27 — Malicious Dependencies

AI projects frequently rely on open-source libraries.

Threats include:

• Malicious packages

• Dependency confusion

• Compromised maintainers

• Vulnerable libraries

Software supply-chain security is therefore part of AI security.

28 — Malicious or Untrusted Models

Organizations may download models from external repositories.

Risks include:

• Tampered model files

• Malicious artifacts

• Unknown training history

• Backdoors

• Licensing issues

Model provenance is important.

29 — Third-Party AI Provider Compromise

Organizations may rely on external AI services.

A provider breach could affect:

• Prompt confidentiality

• Customer data

• API credentials

• Availability

• Model access

Third-party risk management becomes essential.

30 — Shadow AI

Employees may use unauthorized AI tools.

Example:

Developer
   ↓
Copies Internal Source Code
   ↓
Public AI Service

Potential impact includes:

• Intellectual property leakage

• Customer data exposure

• Compliance violations

Shadow AI is one of the most practical enterprise AI risks.

31 — Insider Data Exfiltration Using AI

A malicious insider may use an enterprise AI assistant to accelerate data discovery.

Example:

Insider
   ↓
AI Assistant
   ↓
Searches Enterprise Knowledge
   ↓
Sensitive Data Collection

Strong authorization and monitoring are important.

32 — AI-Generated Insecure Code

Developers may use AI to generate software.

AI-generated code may contain:

• Vulnerabilities

• Weak authentication

• Hard-coded secrets

• Unsafe dependencies

• Poor error handling

Generated code should receive the same security review as human-written code.

33 — AI-Generated Misconfiguration

AI assistants may generate:

• Cloud policies

• Firewall rules

• Kubernetes YAML

• Terraform

• IAM policies

Incorrect recommendations could introduce vulnerabilities.

Security engineers should verify AI-generated configuration before deployment.

34 — Hallucination as a Security Risk

AI systems may generate incorrect or fabricated information.

A hallucination becomes a security problem when people or automated systems trust it.

Example:

AI Generates Incorrect Security Command
       ↓
Engineer Executes It
       ↓
Security Control Disabled

The risk depends on how the output is consumed.

35 — Overreliance on AI

Organizations may become overly dependent on AI-generated recommendations.

Potential problems include:

• Reduced human review

• Incorrect decisions

• Automated mistakes

• Loss of operational understanding

Human oversight remains important for high-impact decisions.

AI-Enabled Cyber Threats

There is another side to the threat landscape.

AI is not only something attackers target.

Attackers can also use AI to enhance traditional cyberattacks.

Examples include:

• Phishing

• Social engineering

• Malware development

• Reconnaissance

• Vulnerability research

• Translation

• Automated content generation

Security teams therefore need to consider:

Threats Against AI
        +
Threats Enabled by AI

These are related but different problems.

AI-Enhanced Phishing

Generative AI can help attackers create:

• Better-written phishing emails

• Personalized messages

• Multilingual campaigns

• Large-scale content

This may reduce some traditional indicators of low-quality phishing.

Security awareness and technical controls remain important.

AI-Enhanced Social Engineering

AI may help attackers create more convincing:

• Messages

• Scripts

• Fake profiles

• Support conversations

Organizations should continue using identity verification processes rather than relying only on communication style.

Deepfake Threats

Generative AI may create realistic:

• Audio

• Images

• Video

Potential threats include:

• Executive impersonation

• Fraud

• Social engineering

• Reputation attacks

Organizations may require stronger out-of-band verification for sensitive transactions.

AI-Enhanced Reconnaissance

Attackers may use AI to analyze large amounts of public information.

This may help identify:

• Employees

• Technologies

• Cloud platforms

• Vendors

• Public vulnerabilities

Traditional exposure management becomes increasingly important.

AI and Vulnerability Research

AI can accelerate:

• Code understanding

• Vulnerability analysis

• Documentation review

Defenders also benefit from the same capabilities.

AI therefore changes both attacker and defender productivity.

AI Threats and Business Impact

Not every threat has the same business impact.

An AI Security Engineer should consider:

• Confidentiality impact

• Integrity impact

• Availability impact

• Financial impact

• Privacy impact

• Regulatory impact

• Operational impact

• Reputation impact

Confidentiality Impact

Examples:

• Customer data exposure

• Model theft

• Source-code leakage

Integrity Impact

Examples:

• Poisoned model

• Manipulated RAG data

• Unauthorized AI actions

Availability Impact

Examples:

• Resource exhaustion

• Model API outage

• Denial-of-service

Financial Impact

Examples:

• API abuse

• Fraud

• Cloud resource theft

Reputation Impact

Examples:

• Harmful AI responses

• Public data leakage

• Unsafe automated actions

Threat Likelihood

Likelihood considers how likely the threat is to occur.

Factors may include:

• Internet exposure

• Required privileges

• Attack complexity

• Existing controls

• Threat actor capability

• Ease of exploitation

Example:

Public Application
+
No Authentication
+
Sensitive Data

may have higher likelihood than:

Private System
+
Restricted Network
+
Strong MFA
+
Limited Access

Threat Impact

Impact considers what happens if the threat succeeds.

Factors include:

• Data sensitivity

• Permission level

• Business criticality

• Number of affected users

• Ability to recover

A simple risk concept is:

Risk ≈ Likelihood × Impact

This is not always a precise mathematical equation, but it is a useful way to think about prioritization.

Threat Prioritization Example

Consider two findings.

Threat A

Public chatbot produces unusual responses.

No sensitive data.

No tools.

No enterprise access.

Threat B

Internal AI agent has cloud administrator access and can be influenced by untrusted documents.

Threat B deserves significantly greater attention.

Why?

Because the potential impact is much higher.

Threat Modeling Mindset

When reviewing threats, ask:

Who Is the Threat Actor?
        ↓
What Do They Want?
        ↓
How Can They Reach the System?
        ↓
What Weakness Could They Exploit?
        ↓
What Asset Can They Reach?
        ↓
What Would the Business Impact Be?

This will become important in the dedicated threat modeling module.

Enterprise Scenario

Imagine a company deploys an AI security assistant.

Architecture:

Security Analyst
      │
      ▼
Enterprise AI Assistant
      │
      ├── LLM
      ├── RAG
      │     └── Security Documentation
      │
      └── Agent
             ├── SIEM
             ├── Cloud Logs
             └── Ticketing System

Let’s identify possible threats.

Threat 1 — Stolen Analyst Account

Attacker
   ↓
Compromised Analyst Credential
   ↓
AI Assistant
   ↓
Sensitive Security Information

Traditional identity threat.

Threat 2 — Malicious RAG Document

Malicious Document
       ↓
RAG
       ↓
Indirect Prompt Injection
       ↓
AI Agent

AI-specific threat.

Threat 3 — Excessive Agent Permission

The agent may have permission to modify security tickets when only read access is required.

Threat 4 — API Credential Exposure

The LLM API credential could be leaked through source code.

Threat 5 — Sensitive Logging

Prompts containing incident data may be stored in logs.

Threat 6 — Third-Party Provider Risk

Security information may be sent to an external model provider.

Threat 7 — Insider Abuse

A security analyst may intentionally search for information outside their responsibilities.

This demonstrates why AI threats must be reviewed across the complete architecture.

Threat-to-Control Thinking

Security engineers should move from:

Threat

to:

Threat
   ↓
Preventive Control
   ↓
Detective Control
   ↓
Response

Example:

Threat

API key theft.

Preventive Controls

• Secret manager

• Workload identity

• Least privilege

• Credential rotation

Detective Controls

• Unusual API usage monitoring

• Credential activity alerts

Response

• Revoke credential

• Rotate secret

• Investigate usage

• Review exposed data

This is enterprise security thinking.

Common Beginner Mistakes

Mistake 1 — Thinking Every AI Threat Is Prompt Injection

The AI threat landscape is much broader.

Mistake 2 — Ignoring Traditional Cyber Threats

Credential theft may be more damaging than an advanced model attack.

Mistake 3 — Ignoring Insider Risk

Legitimate access can still be abused.

Mistake 4 — Ignoring Third Parties

External AI providers become part of the security boundary.

Mistake 5 — Focusing Only on Technical Impact

Business, privacy and financial impact also matter.

Mistake 6 — Treating All Threats Equally

Threats should be prioritized based on likelihood and impact.

Mistake 7 — Ignoring AI-Enabled Attacks

Attackers can use AI to improve traditional attacks.

AI Security Engineer Threat Checklist

Threat Actors

• External attackers identified

• Insider risks considered

• Third-party threats considered

• Supply-chain threats considered

Data Threats

• Sensitive data exposure

• Training data poisoning

• RAG poisoning

• Data inference

• Data integrity risks

Model Threats

• Model theft

• Model tampering

• Model extraction

• Untrusted models

• Model backdoors

LLM Threats

• Prompt injection

• Indirect prompt injection

• Jailbreaking

• Sensitive information disclosure

• Unsafe output

Agent Threats

• Excessive agency

• Tool abuse

• Unauthorized actions

• Agent memory manipulation

• Multi-agent trust

Infrastructure Threats

• Cloud compromise

• Container risks

• Kubernetes risks

• Credential theft

• Resource abuse

Supply Chain

• Dependency risk

• CI/CD compromise

• MLOps compromise

• Model repository compromise

Third Party

• AI provider risk

• External API risk

• Vendor data exposure

Operations

• Logging risk

• Detection capability

• Incident response readiness

Interview Perspective

You may be asked:

What are the main threats to enterprise AI systems?

A strong answer is:

Enterprise AI systems face both traditional cybersecurity threats and AI-specific threats. Traditional risks include credential theft, API vulnerabilities, cloud misconfiguration, supply-chain compromise and insider abuse. AI-specific risks include prompt injection, indirect prompt injection, data poisoning, model theft, RAG manipulation, excessive AI agent permissions and unsafe model output. The threat should be evaluated across the full architecture, not only the model.

Another common question may be:

What is the difference between a threat against AI and an AI-enabled threat?

A strong answer is:

A threat against AI targets an AI system itself, such as poisoning a dataset or manipulating an AI agent. An AI-enabled threat is a traditional cyberattack that becomes faster or more scalable through AI, such as AI-assisted phishing or reconnaissance.

Another question may be:

How do you prioritize AI security threats?

A strong answer is:

I would consider the likelihood of successful exploitation and the potential business impact, including data sensitivity, privileges, system exposure, operational impact, privacy, financial impact and recoverability. An issue involving a privileged AI agent connected to production would usually deserve greater priority than a low-impact behavior issue in an isolated chatbot.

Key Takeaways

The AI security threat landscape includes:

Cybercriminals
+
Nation-State Actors
+
Insiders
+
Supply-Chain Attackers
+
Third Parties
+
Accidental Users

Threats may target:

Prompts
+
Data
+
Models
+
RAG
+
Agents
+
APIs
+
Cloud
+
CI/CD
+
MLOps
+
Third-Party Services

Important AI-specific threats include:

• Prompt injection

• Indirect prompt injection

• Sensitive information disclosure

• Data poisoning

• RAG poisoning

• Model theft

• Model manipulation

• Agent abuse

• Excessive agency

• Unsafe output handling

AI also enables attackers to improve traditional attacks.

The most important mindset is:

Do not ask only what can attack the AI. Ask who may attack it, why they would attack it, how they could reach it and what business impact they could create.

What’s Next?

➡️ 07 — OWASP Top 10 for LLM Applications

You now understand the broader AI security threat landscape.

The next step is to organize many of these risks using one of the most useful application-security references for modern LLM systems.

In the next lesson, you will learn how to use the OWASP Top 10 for LLM and Generative AI Applications to identify and communicate common security risks.

You will explore areas such as:

• Prompt injection

• Sensitive information disclosure

• Supply-chain risk

• Data and model poisoning

• Improper output handling

• Excessive agency

• System prompt leakage

• Vector and embedding weaknesses

• Misinformation

• Unbounded resource consumption

Most importantly, you will learn how to use OWASP as a security assessment framework, rather than simply memorizing ten names.

➡️ Next: 07 — OWASP Top 10 for LLM Applications