Software you can talk into things
Traditional security assumes attackers exploit bugs. AI systems add a stranger risk: they can be persuaded. A support bot talked into revealing another customer's data, an agent instructed by a malicious email to forward files — these aren't hypotheticals; they're the standard findings of every AI red-team exercise we run.
The mental shift for security teams: the model is not a component you harden once. It's closer to a capable, literal-minded new employee — useful precisely because it acts on language, and vulnerable for exactly the same reason.
The new attack surface, mapped
Four risk classes cover most of what we find in AI security assessments.
- Prompt injection: hostile instructions hidden in the content a system reads — emails, documents, web pages — that hijack its behavior. The AI equivalent of SQL injection, and just as common.
- Data leakage: models that see more than the current user should — cross-tenant context, secrets pasted into prompts, retrieval indexes without access controls.
- Over-privileged agents: an agent with write access to systems it only needs to read is one clever manipulation away from being an insider threat.
- Supply-chain exposure: third-party models, plugins, and MCP-style tool servers each extend your trust boundary to someone else's code and weights.
Defense in depth still works
None of this requires abandoning what security teams already know — it requires applying it to a new layer. Least privilege for agents: scoped credentials per workflow, never a master key. Input isolation: content the model reads is data, never trusted instructions, and the system prompt says so explicitly. Output validation: anything the model produces that triggers an action gets checked against policy before execution. And human gates at the consequential moments — payments, external sends, deletions.
Then test it the way attackers will: red-team the prompts, not just the ports. We run adversarial suites against every agent before launch — hundreds of injection, exfiltration, and privilege-escalation attempts — and re-run them on every change, exactly like the evaluation gates we use for quality.
Governance closes the loop
Security and governance are the same discipline at different altitudes. Decision-level logs turn incidents from mysteries into replayable events. Escalation thresholds cap the blast radius of any single bad decision. And rollback paths mean recovery is an operation, not an emergency. Teams that build these in from day one ship AI their auditors, customers, and regulators can live with — and expand faster because of it.
Written by SCORPBIT Security Practice — humans working with AI at every step, accountable for every word.
