️ Pillar Guide · P1 Attack Vectors · The Foundation
What Is AI Security? The Complete Threat Landscape (2026)
AI systems don't just store data — they interpret instructions, retrieve information, call external tools, and make autonomous decisions. That changes everything about how they can be attacked. This guide maps the complete AI security landscape: every major attack category, every defense layer, and every compliance obligation your organisation needs to understand.
Traditional cybersecurity protects deterministic systems — a web server either accepts a valid request or it doesn't. The same input always produces the same output. Defences can be built around known attack signatures, fixed code paths, and auditable access controls.
AI systems are non-deterministic. They interpret instructions probabilistically, generate outputs based on context, retrieve information dynamically, and increasingly take autonomous actions. This creates attack surfaces that traditional security tools are structurally blind to:
A WAF inspects HTTP requests for exploit signatures — prompt injection is semantically valid text that passes every WAF rule
A SIEM monitors authentication events — agent compromise uses legitimate credentials; no authentication anomaly fires
An antivirus scans for malware signatures — RAG poisoning is a valid document file containing valid text
The key insight: AI security failures don't look like traditional security incidents. An AI data breach may produce no firewall alerts, no malware detections, no authentication anomalies, and no unusual network traffic. The attack happened entirely in the reasoning layer — and without AI-specific monitoring, the first indication is a user noticing something strange in a response.
The Six Major AI Attack Categories
Category 01
Prompt-Level Attacks
The most common AI attack category. Adversarial instructions override intended behaviour — delivered directly, hidden in retrieved content, or embedded in non-text media.
Direct prompt injection — user-supplied override instructions
Indirect injection — malicious instructions in retrieved documents
Multimodal injection — instructions hidden in images, PDFs, audio
Jailbreaking — safety control bypass via framing and encoding
Persistent injection — instructions stored in agent memory
The fastest-growing attack surface. AI agents that can take actions — call APIs, send emails, modify records — have dramatically higher blast radius when compromised.
Tool abuse — agent manipulated to misuse connected systems
Tool chaining attacks — individually legitimate steps form malicious chain
MCP server exploitation — central access points compromised
Memory poisoning — false information stored in long-term agent memory
Permission escalation — agent accesses systems beyond defined scope
Multi-agent chain compromise — taint propagates through trust relationships
Not every AI security incident starts with a technical exploit. Many originate from governance gaps — untested systems, missing policies, and unmanaged third-party risk.
No AI inventory — unknown systems with unknown risk
Missing security testing — vulnerabilities undiscovered until exploited
No incident response — AI incidents escalate uncontrolled
Regulatory gaps — NIST AI RMF, EU AI Act, HIPAA, PCI DSS failures
Third-party AI risk — unreviewed vendors processing sensitive data
Most organisations don't build complete AI stacks. Every foundation model, plugin, MCP server, and framework dependency is a potential entry point for supply chain compromise.
Foundation model supply chain — compromised upstream model
Dependency poisoning — malicious packages in AI workflows
Plugin and MCP connector compromise — third-party integrations as vectors
Vendor security failures — weak controls at AI API providers
Shadow AI — unauthorised tools processing sensitive data
AI incidents are visible to end users in ways infrastructure breaches aren't. Customer trust erodes quickly when AI behaviour becomes publicly anomalous.
The AI Security Defense Framework — 5 Layers
01
Governance
AI inventory, risk classification by system, security ownership assignment, and documented policies covering approved tools, restricted data, agent permissions, and incident reporting. Without governance, every other layer is inconsistently applied. Build your AI security programme →
02
Security Testing
Prompt injection testing, agent security validation, RAG access control testing, and AI red teaming — before deployment and quarterly thereafter. AI systems change continuously; security testing must keep pace. AI pen testing methodology →
03
Access Control
Least privilege for AI agents and users, role-based retrieval permissions, chunk-level authorisation in RAG systems, tenant isolation in multi-tenant deployments. Access control limits blast radius — it determines the maximum damage from any successful attack. Permission governance framework →
04
Runtime Monitoring
Real-time detection of prompt anomalies, unusual agent behaviour, retrieval scope violations, and output anomalies. Build behavioural baselines in the first two weeks of production. Alert on deviations. Most AI attacks are invisible to traditional monitoring — AI-specific observability is required. Agent monitoring guide →
05
Incident Response
AI-specific playbooks for prompt injection incidents, data leakage events, agent compromise, model poisoning, and supply chain failures. The evidence is in prompt logs and AI output logs — not firewall logs. Traditional IR procedures are insufficient. Full IR playbook →
️ See Where You Stand — Free AI Security Assessment
The HexTyx AI Security Assessment scores your posture across all 5 defense layers in 10 minutes. Identify your highest-risk gaps before attackers or auditors find them.
AI security is the discipline of protecting AI systems — LLMs, AI agents, RAG pipelines, autonomous workflows, and AI APIs — from attacks, misuse, and governance failures. It is fundamentally different from traditional cybersecurity because AI systems make decisions, retrieve information, use tools, and operate autonomously, creating attack surfaces that traditional security tools cannot see.
Why do AI systems require different security controls?
AI systems are non-deterministic — the same input can produce different outputs depending on context. This means traditional signature-based defences don't work: prompt injection is valid text, RAG poisoning is a valid document, and agent compromise uses legitimate credentials. AI security requires semantic-level detection, behavioural monitoring, and AI-native testing methodologies that assess system behaviour, not just code vulnerabilities.
What is prompt injection and why is it dangerous?
Prompt injection is an attack where an adversary crafts input that causes an AI to override its intended instructions and follow the attacker's instructions instead. It is dangerous because it requires no infrastructure compromise, leaves no malware or authentication anomalies, and in agentic systems can cause the AI to take real-world actions — exfiltrating data, sending communications, modifying records — using its own legitimate permissions.
Where should I start with AI security?
Start with governance: do an AI inventory (what systems do you have?), classify them by risk (what data do they access, what can they do?), and define a simple data policy (what can employees submit to AI tools?). Then run a security assessment to identify your highest-risk gaps. The HexTyx free assessment covers all five defence layers in 10 minutes.
Explore the Complete Knowledge Base
This pillar article is the entry point for the entire HexTyx AI security library. Every topic below links to dedicated deep-dive guides.