What are the common security risks in AI applications?

Short answer

The distinctive risks come from treating model input as trusted. Indirect prompt injection — instructions hidden in a web page, document or email the model reads — turns a helpful agent into a confused deputy acting with its own permissions. Around that sit data leakage through prompts and logs, over-broad tool and retrieval permissions, insecure handling of model output that reaches shells or databases, and supply-chain exposure through models, plugins and connectors.

How it works

A model cannot reliably separate instructions from data, because both arrive as text in one context. Any content the model reads is therefore potentially an instruction, and any tool it holds is potentially available to whoever authored that content. The consequence is a permissions problem: exposure is bounded by what the agent's credentials can do, not by how carefully it was prompted.

The second class is output handling. Model output interpolated into SQL, a shell command, a template or a browser is injection in the classical sense, and it deserves the same treatment any untrusted string would get.

Example

An agent summarising a supplier's PDF encounters a line instructing it to email its context to an outside address. Nothing about that line looks unusual to the model; whether the email leaves depends entirely on whether the runtime allows it. Real-world cases of injection delivered through ordinary web content have been documented by security researchers, so this is an operational risk rather than a theoretical one.

Why it matters

Existing controls mostly apply — least privilege, egress restrictions, output encoding, secrets hygiene, audit logs — but they must be applied to the agent as a principal rather than to the model as a component. Organisations that treat prompt text as a security boundary are the ones that get surprised.

Common misunderstandings

That a strong system prompt prevents injection. It is guidance, not enforcement, and can be overridden by content in context.

That local or open-weight models remove the risk. They change who holds the data, not whether instructions can hide in inputs.

That injection needs a malicious user. The user is often the victim; the attacker is whoever wrote the content the agent read.