TL;DR

AI is no longer just a tool in your security stack — it is now an attack surface. From model theft costing organisations millions in stolen IP to data poisoning campaigns that corrupt your AI from the inside, the threat landscape has fundamentally shifted. Business leaders need to understand four critical risk areas: AI-powered social engineering, prompt injection against AI agents, model exfiltration, and the governance structures required to keep up.

The Threat Landscape Has Changed

AI does not merely automate old attack patterns. It introduces entirely new categories of risk that traditional security controls were never designed to address. Nation-state actors are already leveraging AI at scale — the ASD ACSC flagged joint advisories in 2026 documenting Chinese and Russian cyber campaigns that increasingly incorporate AI-driven reconnaissance and targeting. Meanwhile, your own AI investments — the models you trained, the data pipelines you built — are themselves valuable targets.

A single fine-tuned foundation model can represent $2–10 million in compute costs, data curation labour, and competitive advantage. Losing it is not a data breach; it is an IP theft event with compounding consequences.

1. AI-Powered Phishing and Deepfake Social Engineering

AI has weaponised social engineering. Large language models generate phishing emails that are grammatically flawless, contextually personalised, and virtually indistinguishable from legitimate correspondence. Deepfake voice and video technology has moved from research labs into active criminal use.

Real-world impact:

  • In 2024, a Hong Kong finance worker was deceived into transferring $25 million after attending a video conference call where every other participant — including the CFO — was a deepfake. This was not a proof of concept; it was a live attack.
  • AI voice cloning now requires as little as 3 seconds of source audio. Commercial tools like ElevenLabs and open-source alternatives have democratised this capability, lowering the barrier from nation-state to individual threat actor.
  • The UK's National Cyber Security Centre (NCSC) has warned that AI is "almost certainly increasing the volume and impact of cyber attacks" — specifically citing phishing as the area seeing the most immediate uplift.

What to do:

  • Implement out-of-band verification for any financial transaction above a defined threshold. A phone call to a known number is no longer sufficient; use a pre-agreed code word or secondary channel.
  • Deploy deepfake detection tools such as Microsoft's Video Authenticator or Reality Defender's API within your communication platforms.
  • Train staff specifically on AI-generated content. Generic "spot the phish" training does not prepare people for a cloned voice on a live call.
  • Budget: Deepfake detection platforms typically run $15,000–50,000/year for enterprise deployment. Put it in context — that is less than 0.2% of what the Hong Kong firm lost.

2. Prompt Injection and AI Agent Security

As organisations deploy AI agents that can read email, execute code, query databases, and take actions on behalf of users, a new class of vulnerability has emerged: prompt injection. An attacker crafts input that causes the AI to ignore its instructions and execute the attacker's will instead.

How it works:

  • Direct prompt injection: An attacker sends a malicious instruction embedded in an email or document. When your AI agent processes it, the agent interprets the hidden instruction as a command — potentially exfiltrating data, sending emails, or modifying records.
  • Indirect prompt injection: The malicious payload is hidden in a webpage, PDF, or data source your AI agent retrieves. The agent never sees the attacker directly; the poisoned content does the work.
  • Agent tool abuse: Agentic AI systems with access to APIs, file systems, or shell commands can be tricked into chaining actions in unintended ways. The ASD ACSC released joint guidance in 2026 specifically warning about the risks of agentic AI services, recommending organisations adopt them "carefully, prioritising secure and resilient use."

What to do:

  • Treat every external input to an AI agent as untrusted. Implement input sanitisation layers between the LLM and external data sources.
  • Enforce the principle of least privilege on AI agent tool access. If your customer service agent does not need database write access, do not give it database write access.
  • Use guardrail frameworks such as NVIDIA NeMo Guardrails, Microsoft's Prompt Shields (built into Azure AI Content Safety), or Lakera Guard to detect and block injection attempts at inference time.
  • Run red-team exercises against your AI agents before deployment. Tools like Garak (the Generative AI Red-teaming and Assessment Kit) automate adversarial testing of LLM vulnerabilities.

3. Model Theft and Data Poisoning

Your AI models are intellectual property, and they are being stolen. Model theft — also called model exfiltration or model skimming — occurs when attackers extract the weights, architecture, or behavioural equivalence of your proprietary model through API access, insider threats, or direct infrastructure compromise.

Model theft scenarios:

  • API-based extraction: An attacker queries your model endpoint thousands of times, then trains a "knock-off" model that mimics its behaviour. Research has shown that attacking commercial APIs like OpenAI's can reproduce model outputs at a fraction of the original training cost.
  • Insider exfiltration: A departing employee copies model weights to a personal device. Given that model files for large models can be tens or hundreds of gigabytes, data loss prevention (DLP) tools that ignore large binary transfers will miss this entirely.
  • Supply chain compromise: A dependency or plugin in your ML pipeline is compromised, silently exfiltrating model artefacts during training or deployment. The same technique used in the SolarWinds attack applies to MLOps tooling.

Data poisoning:

Data poisoning attacks corrupt the training data your models learn from, embedding backdoors or biases that persist undetected. A poisoned model performs normally on standard benchmarks but produces attacker-controlled outputs on specific trigger inputs. This is particularly dangerous for organisations that rely on web-scraped data, user-generated training sets, or third-party data providers.

What to do:

  • Encrypt model weights at rest and in transit. Use hardware security modules (HSMs) or trusted execution environments (TEEs) for inference serving.
  • Implement query-rate limiting and anomaly detection on model APIs. Sudden spikes in API volume with systematically varied inputs are a hallmark of extraction attacks.
  • Apply data provenance tracking to training pipelines. Tools like Dolt (versioned SQL databases) or LakeFS (versioned data lakes) let you track exactly what data entered your model and when.
  • Run model integrity checks. Microsoft's Counterfit and IBM's Adversarial Robustness Toolbox can test for backdoor behaviours in trained models.

4. Governance Frameworks Your Board Actually Needs

Technical controls are necessary but insufficient. AI security demands governance structures that cross traditional silos — blending cybersecurity, data science, legal, and executive oversight.

The NIST AI Risk Management Framework (AI RMF) provides a structured approach organised around four functions: Govern, Map, Measure, and Manage. It is the closest thing to an industry standard and is increasingly referenced in procurement requirements and regulatory expectations.

Practical governance steps:

  1. Establish an AI security working group that includes your CISO, head of data science, legal counsel, and a business stakeholder. Meet monthly. This is not a committee for slide decks; it should have authority to block deployments that fail security review.
  2. Maintain an AI asset inventory. You cannot protect what you do not know about. Document every model in production, its training data provenance, its access controls, and its business criticality.
  3. Define acceptable use policies for AI tools. Cover both internal use (which AI tools employees can use, with what data) and external risk (how AI-generated content is verified before it reaches customers).
  4. Adopt the ASD ACSC's guidance on agentic AI: their 2026 joint advisory on careful adoption of agentic AI services provides a checklist covering access controls, monitoring, and fallback mechanisms specific to autonomous AI agents.
  5. Budget for AI security as a line item. Gartner estimates that by 2027, AI-specific security spending will need to represent at least 10% of total cybersecurity budgets for organisations deploying AI at scale. Most are currently at 1–2%.

FAQ

Q: Is model theft really a practical concern for mid-sized businesses? A: Yes. If you have invested in fine-tuning models on proprietary data, that model encodes competitive advantage. Competitors — or nation-state actors — can steal it via API access or insider threats. The cost to recreate a fine-tuned model from scratch can exceed $5 million; the cost to extract it via API queries is often under $50,000.

Q: How is data poisoning different from a regular data breach? A: A data breach steals data. Data poisoning corrupts it. The damage is not in what the attacker learns — it is in what your AI model learns. A poisoned model can function normally for months, producing correct outputs for most inputs while containing embedded backdoors that the attacker can trigger at will.

Q: Do we need separate security tools for AI, or do existing tools cover it? A: Existing tools cover infrastructure (network security, endpoint protection, identity management) but miss AI-specific risks like prompt injection, model extraction, and adversarial inputs. You need purpose-built AI security tooling — guardrail frameworks, adversarial testing suites, and model monitoring — layered on top of your existing stack.

Q: What should we do first if we have limited budget? A: Start with an AI asset inventory and access control review. Know what models you have, who can access them, and what data they touch. Then implement query-rate limiting on any model-facing API. These two steps address the highest-probability attacks at minimal cost.

Conclusion

AI is simultaneously the most powerful defensive tool and the most dangerous new attack surface your organisation has ever faced. The threats — deepfake fraud that bypasses human judgment, prompt injection that turns your AI agents against you, model theft that steals millions in IP, and data poisoning that corrupts your systems from within — are not theoretical. They are active, escalating, and already being exploited by both criminal and state-sponsored actors.

The organisations that weather this shift will be those that treat AI security as a first-class discipline, not an afterthought appended to existing cybersecurity programmes. Build the governance, deploy the tooling, train your people, and test your systems before someone else tests them for you.

Visit consult.lil.business for a free cybersecurity assessment and find out where your AI investments are exposed.

References

  1. ASD ACSC — Joint Guidance on Agentic AI Services (2026): Guidance on secure adoption of agentic AI, including access controls, monitoring, and fallback mechanisms. https://www.cyber.gov.au/resources-business-and-government/guidance/new-joint-guidance-provides-mitigations-careful-adoption-agentic-ai-services

  2. NIST AI Risk Management Framework (AI RMF 1.0): The foundational US framework for managing AI risk across the Govern, Map, Measure, and Manage functions. https://www.nist.gov/artificial-intelligence/executive-order-safe-secure-and-trustworthy-artificial-intelligence

  3. NCSC UK — The Near-Term Impact of AI on the Cyber Threat: Assessment of how AI is increasing the volume and sophistication of cyber attacks, including phishing and social engineering. https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat

  4. ASD ACSC — Using AI to Strengthen Cyber Defence (2026): Guidance on how organisations can leverage AI defensively while understanding the associated risks. https://www.cyber.gov.au

  5. OWASP Top 10 for Large Language Model Applications: Community-driven list of the most critical vulnerabilities in LLM applications, including prompt injection, supply chain risks, and data leakage. https://owasp.org/www-project-top-10-for-large-language-model-applications/