AI Security

A different kind of vulnerability

A model weakness is not a line of code you can patch. Because a model's behaviour is statistical, a fix means changing the system prompt, filtering inputs and outputs, re-architecting how the model is used, or fine-tuning, and testing it means sampling many attempts rather than a single pass or fail. That is why AI security sits on the security desk: the failures are security failures, but the tools to find and fix them are their own discipline.

Prompt injection: the number-one risk

Prompt injection has held the top spot in the OWASP Top 10 for large language model applications across two editions. It comes in two forms:

• Direct injection: a user types instructions that override the system's intent, the classic "ignore your previous instructions" jailbreak.
• Indirect injection: the dangerous one. Adversarial instructions are hidden inside content the model retrieves, a web page, a document, an email, a code comment, so the attacker never touches the prompt box. It is exploitable across every retrieval-augmented and agentic deployment without special access.

Agentic amplification

The reason this is worse in 2026 is agents. When a model can call tools, browse, run code and remember, a single injected instruction stops being a wrong answer and becomes a coordinated attack chain: it can hijack the agent's plan, trigger privileged tool calls, persist itself in the agent's memory, and propagate across every system the agent is connected to. OWASP's new Top 10 for Agentic Applications (2026) names this directly as Agent Goal Hijack. It is the single biggest shift in the field's threat model.

The wider attack surface

Beyond injection, the recognised vectors an AI system has to defend against include:

• Data and model poisoning: corrupting training or fine-tuning data to plant backdoors or bias.
• Sensitive information disclosure: coaxing out training data, secrets or the system prompt itself.
• Insecure output handling: trusting model output and passing it straight into a browser, shell or database, turning a bad answer into cross-site scripting or code execution.
• Excessive agency: granting an agent more permission, tools or autonomy than the task needs, so a single failure has a large blast radius.
• Supply chain: compromised model weights, poisoned open-weight checkpoints, malicious plugins and dependencies.
• Model theft and extraction: stealing weights, or reconstructing a model's behaviour through its API.
• Synthetic media: deepfakes and cloned voices used for fraud and social engineering.

Where the defences stand

The honest position: prompt injection has no complete fix. You cannot make a model reliably tell trusted instructions from untrusted content inside the same context window. So the real work is containing the blast radius, and mature deployments layer several controls:

• Treat every model output as untrusted input to the next system.
• Give agents least-privilege tool access, and require human approval for high-impact actions.
• Sandbox tool execution, and allow-list the sources a model is permitted to retrieve.
• Filter inputs and outputs with guardrails, and harden the system prompt.
• Red-team continuously with statistical sampling, not one-off checks.

The reference frameworks are the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, and the NIST AI Risk Management Framework. For the systems behind the risk, see our Agentic AI hub.