AI Threat Awareness Program

AI Threat Overview

Six threats make up the current taxonomy. Four are vectors, how exposure is created. Two are impacts, what it costs when a vector succeeds.

ID	Threat	Type	What it is
AI-01	Shadow AI	Vector	Unsanctioned LLMs and agents used outside governance
AI-02	Rogue Agent	Vector	A sanctioned agent given more autonomy than its task needs
AI-03	Prompt Injection	Vector	Hidden instructions override the model's intended behavior
AI-04	Model & Data Supply Chain	Vector	Unvetted models, training data, or plugins carrying hidden risk
AI-05	Data Exfiltration	Impact (from AI-01/02/03)	Sensitive data leaves company control
AI-06	Hallucination	Impact (from AI-04 & over-reliance)	Confident but false output acted on unverified

Technical Deep-Dive

Each threat below follows the same structure: what it is, how it typically plays out end to end, what to watch for, and what closes the gap.

AI-01 · Shadow AI

Employees use unsanctioned LLMs, agents, or local models outside IT and InfoSec governance. These tools inherit the user's personal-level access with no DLP coverage and no audit trail.

Exploit chain

1. An employee uses a personal AI account for a work task.
2. The vendor's consumer terms of service apply, not a corporate agreement.
3. Prompts and data are logged or used for training outside company control.
4. The data is later exposed through a vendor breach or reproduced in model output.

Indicators
• Outbound traffic to AI service domains from non-corporate accounts
• DLP alerts flagging AI-related data egress
• Unapproved browser extensions or local model runners on endpoints

Remediation
• Stand up a formal AI intake and sanctioning process
• Block or allowlist AI domains at the proxy
• Provide a sanctioned enterprise AI alternative
• Apply DLP monitoring with no exemptions, sanctioned tools included

AI-02 · Rogue Agent

A sanctioned AI agent is granted more tools, data access, or autonomy than its task requires, and acts on faulty output without a human check.

Exploit chain

1. An agent is provisioned with broad API or database credentials.
2. A bad input, hallucination, or injected instruction triggers an unplanned tool call.
3. No human approval gate exists for that action.
4. The action executes, and is only logged, if at all, after the fact.

Indicators
• The agent invokes tools or APIs outside its expected scope
• An irreversible action is taken with no approval step
• A service account holds write or delete access where read-only would do

Remediation
• Grant least-privilege, per-user scoped credentials, not shared high-privilege accounts
• Require human approval before high-impact or irreversible actions
• Enforce authorization on the backend system, never trust the model's own judgment
• Log all agent activity and rate-limit sensitive operations

AI-03 · Prompt Injection

Instructions hidden in user input, or in content the model reads, such as a document, email, or web page, override the system's intended instructions.
Exploit chain

1. An attacker embeds a hidden instruction inside external content.
2. An agent ingests that content as part of a routine task.
3. The model follows the injected instruction instead of the user's intent.
4. The result is a data leak or an unauthorized action.

Indicators
• Output tone or content shifts unexpectedly mid-task
• The agent references instructions the user never gave it
• An unusual tool call follows immediately after reading external content
Remediation
• Treat all ingested or retrieved content as untrusted data, never as instructions
• Apply runtime guardrails to every agent, with no exceptions for trusted-looking sources
• Keep the system prompt's privilege segregated from user- and content-supplied text
• Red-team live prompts and agents on a recurring schedule

AI-04 · Model & Data Supply Chain

Pretrained models, fine-tuning datasets, or plugins sourced from unvetted third parties can carry backdoors, poisoned data, or undisclosed license and IP exposure.

Exploit chain

1. A team pulls a model or dataset from a public source without vetting it.
2. A backdoor or biased pattern is embedded during training and goes unnoticed.
3. The model is deployed into production.
4. A specific trigger input later activates the malicious or skewed behavior at scale. Indicators • No documented provenance for a model currently in use • No entry for the model in an AI or model inventory • Behavior drift after what the vendor called a minor update Remediation • Maintain a signed model and AI inventory (an AI bill of materials) • Vet provenance and attestation before adopting any model or dataset • Red-team new models before deployment • Secure contractual audit rights with model and data vendors

AI-05 · Data Exfiltration

Regulated or sensitive data leaves the organization's control through a prompt, an agent's tool call, or a vendor's retention or training policy. This is a common outcome of Shadow AI, Prompt Injection, and Rogue Agent behavior.

Exploit chain

1. Sensitive data enters a prompt or an agent's working context.
2. No content-level DLP inspects that data before it leaves.
3. The data reaches an external model or an over-permissioned tool.
4. It is retained, logged, or acted upon outside company control.

Indicators
• Sensitive terms surfacing in prompt or agent logs
• A vendor without a zero-retention or no-training clause
• Regulated data, PII, PHI, or source code, seen on an unmonitored AI channel
Remediation
• Apply content-aware DLP to every AI channel, sanctioned or not
• Tie data classification directly to what may enter a prompt
• Require zero-retention terms in every AI vendor contract
• Redact or tokenize sensitive fields before submission where feasible

AI-06 · Hallucination

The model produces confident but false or fabricated output, such as a citation, a figure, or a policy clause, and someone acts on it without verifying it. This is most common where training data quality is poor or where staff over-rely on AI output.

Exploit chain

1. The model generates a plausible-sounding but incorrect answer.
2. The output carries no indication of uncertainty.
3. A user or downstream system trusts it without verification.
4. A decision, filing, or communication is made based on false information.

Indicators
• Unverifiable citations, figures, or policy clauses
• Output that contradicts known source documents
• No human review step before the content is used externally
Remediation
• Require human review for any external or high-stakes output
• Require sourced, grounded answers over freeform generation where accuracy matters
• Train staff on automation bias and the habit of verifying before acting