Securing AI Workloads: New Risks and How to Address Them

Every significant shift in computing has brought its own class of security risks. Cloud computing introduced misconfiguration at scale. Artificial intelligence is no exception.

What distinguishes AI is that some of its vulnerabilities do not fit neatly into established security categories. A model is not merely software; it is software whose behavior is shaped by data and by the inputs it receives at runtime. That characteristic creates attack surfaces that conventional controls were never designed to address.

The principal risks

Prompt injection. Malicious instructions, embedded either in user input or in content the model processes, such as documents, emails or web pages, can cause the model to ignore its intended rules, disclose information or take unintended actions. For AI agents with access to tools and systems, this risk is particularly serious.

Sensitive data exposure. Models connected to enterprise data may reveal information to users who should not see it, if retrieval systems do not respect existing access permissions. Confidential information included in prompts may also be logged or retained inappropriately.

Data and model poisoning. If training or fine-tuning data is tampered with, a model may learn harmful behaviors or hidden triggers. Retrieval sources can likewise be poisoned with misleading content.

Model and supply chain risks. Organizations increasingly use third-party models, open-weight models, libraries and datasets. Each introduces dependency risks comparable to those of traditional software supply chains.

Excessive agency. Agents granted broad permissions may take consequential actions based on flawed reasoning or manipulated input.

A framework for defense

AI security should extend existing security disciplines rather than replace them.

Apply least privilege to every model, agent and integration, limiting what data they may access and what actions they may take. Ensure retrieval respects user permissions, so that AI systems cannot become a route around access controls. Deploy input and output screening to detect injection attempts, sensitive data and harmful content. Maintain an inventory of models, datasets and dependencies, with provenance verified and vulnerabilities tracked. Protect training data and model artifacts with the same encryption and access controls applied to other sensitive assets. And log and monitor AI interactions, so that anomalous behavior can be detected and investigated.

Red-teaming, which involves deliberately attempting to manipulate AI systems before and after deployment, should become a routine part of the release process.

Using the platform’s capabilities

Mature cloud AI platforms increasingly provide built-in safeguards, including content filtering, data loss prevention, protection against prompt injection, private networking and comprehensive audit logging. Using these managed controls is generally more reliable than building equivalent protections independently.

The bottom line

AI introduces genuinely new attack surfaces, from prompt injection to model poisoning, but the principles for addressing them are familiar: least privilege, strong data protection, supply chain diligence and continuous monitoring. Organizations that integrate AI security into their existing programs, rather than treating it as an afterthought, will be able to adopt AI with confidence. As agents gain greater autonomy, this discipline is likely to become one of the most important determinants of whether enterprise AI succeeds.