The Security Problems Nobody Talks About in AI Applications

Everyone talks about hallucinations. Fewer people talk about what attackers can do to your AI application.

10 Risks to Add to Your AI Threat Model

1. Indirect prompt injection: A malicious instruction hidden in a web page, PDF, or email that your AI reads, and then obeys.
2. Data exfiltration through rendered output: If the model can output a markdown image or link, an attacker can trick it into embedding private data in a URL that gets sent to their server.
3. Insecure output handling: Model output is untrusted input. Rendering it as HTML, or passing it into a SQL query or shell command, is a classic vulnerability wearing new clothes.
4. Excessive agency: An assistant with permission to send emails, delete records, or run code has a large blast radius when it's manipulated.
5. Poisoned knowledge bases: If anyone can upload to your RAG index, anyone can influence your answers.
6. Cross-tenant leakage: Missing filters in the vector search return another customer's data.
7. Denial of wallet: Attackers don't need to crash you. They just send expensive requests until your API bill does the damage.
8. Leaky logs: Full prompts and responses stored in plain text.
9. Exposed keys: LLM API keys in frontend code or public repos.
10. Supply chain risk: Unvetted models, plugins, and packages pulled into your stack.

Which of these is missing from your threat model?