AI Security

Crafted input alters model behaviour, whether typed directly by a user or planted in content the model later retrieves. No reliable prevention exists, so defence is architectural.

Protected data escapes through memorisation, context and output, embeddings, multimodal channels, or measurable side channels such as token length and latency.

Damaging actions become possible because an agent holds excessive functionality, permissions, or autonomy. This is what turns an injection into an incident.

Compromise reaches the system through third-party models, adapters, datasets, tool packages, and MCP servers rather than through the application itself.

An adversary or unsafe process corrupts training, fine-tuning, or retrieval data so the resulting behaviour is wrong by construction.

Uncontrolled inference lets an attacker drive cost, exhaust capacity, or clone a model through sustained querying.

Confident, incorrect output is relied upon downstream, including hallucinated package names that attackers then register.

Unauthorised extraction or reconstruction of hidden, non-user-authored context such as system prompts, tool definitions, and injected state.

Weaknesses in how embeddings are generated, stored, and searched, including inversion of vectors back into source text and retrieval that ignores access control.

Model output is passed to downstream components without validation, yielding XSS, CSRF, SSRF, SQL injection, or remote code execution.