INDUSTRY FACT FILE · AI, ANALYTICS & AUTOMATION

Threat Landscape: Top Cyber Threats Facing AI Builders and Adopters

The 18 most relevant AI threats, attacks and challenges for AI product firms, chatbot and agent developers, analytics providers and enterprise AI adopters.

AI systems widen the attack surface in three ways: they read untrusted content, they hold or retrieve sensitive data, and they increasingly take actions. Prompt injection, data leakage and excessive agency now sit alongside classic application and cloud threats.

Widely reported cases illustrate the impact: in 2024 a multinational firm reportedly lost about US$25 million after a video call with deepfaked executives, a Canadian tribunal held an airline liable for its chatbot's incorrect advice, and in 2023 engineers at a large electronics firm pasted confidential code into a public chatbot.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by AI segment (Codec Networks assessment).

4.1 Indirect prompt injection

When AI reads emails, tickets, documents or web pages, attackers can hide instructions that the model follows—leaking data or triggering tools.

• Questions to test: Is untrusted content separated from instructions? Are tool calls constrained and approved? Is output filtered for sensitive data?
• Relevant services: indirect prompt injection testing, RAG and agent reviews, output filtering, monitoring.

4.2 Excessive agency

Agents given broad credentials 'to save time' can be steered into destructive or fraudulent actions.

• Questions to test: Are agent permissions scoped to the task? Do high-impact actions require human approval? Is there a kill switch and full action logging?
• Relevant services: agent security review, sandbox testing, approval controls.

4.3 Data leakage and retrieval

RAG systems often index documents without preserving per-user permissions, so a copilot may answer with content the user should never see.

• Questions to test: Does retrieval enforce the requesting user's permissions? Are outputs tested for leakage? Are system prompts and secrets protected?
• Relevant services: retrieval authorisation testing, leakage testing, secrets review.

4.4 Training data and DPDP

Fine-tuning on customer conversations or scraped data can violate data protection law and cause models to repeat personal details.

• Questions to test: Is there a lawful basis and notice for training data? Is PII redacted? Has memorisation been tested?
• Relevant services: DPDPA review for AI data, PII redaction, memorisation testing.

4.5 Model supply chain and deepfakes

Open model files can carry malicious code, and synthetic media enables convincing impersonation for fraud.

• Questions to test: Are models scanned and sourced from approved registries? Are payment instructions verified out of band?
• Relevant services: model supply-chain review, deepfake simulations, payment control testing.

• CERT-In: cyber incidents affecting AI systems reported within six hours.
• IT Rules: intermediaries must label synthetic content and act quickly on flagged unlawful content under the 2026 amendment.
• Privacy: personal data breaches involving AI must be intimated to the Data Protection Board once DPDP breach provisions commence in May 2027.
• Sector regulators: BFSI and other regulated adopters may face supervisory scrutiny of AI failures.
• Customers: contracts may require notification and remediation of AI incidents.

• What happens if our AI reads a malicious instruction in an email or document?
• Which actions can our agents take without human approval?
• Does our retrieval layer respect each user's permissions?
• Do we have a lawful basis and redaction for data used to train our models?
• Where do our models come from, and are they scanned before use?
• Would a deepfaked executive on a video call be able to order a payment?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events.