AI is transforming business operations, but it is also introducing new vulnerabilities. Attacks targeting AI systems are now active and growing in sophistication, making AI security a board-level concern.

TL;DR

  • AI adoption growing fast, driving up organizational risk exposure
  • Threats evolving: data poisoning, prompt attacks, and deepfakes
  • OWASP LLM Top 10 identifies core vulnerabilities for 2025
  • Regulatory gaps emerging as Canada and EU diverge
  • Build layered defences with governance and phased controls

Context

By 2026, over 80 per cent of enterprises will have deployed AI systems, according to Gartner.

AI has shifted from a supporting technology to a mission-critical enabler. This rapid adoption expands the digital attack surface. AI systems are now targeted directly by attackers who exploit weaknesses in data pipelines, models, and integrations.

Attackers are also using AI offensively. Tools like autonomous agents lower the skill barrier for cybercrime, while AI-driven deepfakes make social engineering harder to detect.

Analysis

The evolving threat landscape

Recent incidents show that AI attacks are no longer theoretical. In 2025, attackers used poisoned Google Calendar invites to hijack a Gemini assistant, disrupting smart home systems.

Emerging attack types include:

  • Agent-to-agent prompt infections: Compromised AI agents spreading malicious instructions to peers.
  • Deepfake-enabled phishing: Hyper-realistic voice or video impersonations targeting executives.
  • Supply chain manipulation: Altering embeddings or external data sources in retrieval-augmented generation (RAG) pipelines.

These attacks blend technical exploitation with psychological manipulation, making detection and response harder.

OWASP Top 10 for LLMs

The OWASP LLM Top 10 provides a shared language for understanding AI risks:

Code Risk Name Example Impact
LLM01 Prompt Injection Malicious instructions change behaviour
LLM02 Insecure Output Handling Unsafe actions triggered automatically
LLM03 Training Data Poisoning Corrupted models requiring costly retraining
LLM04 Model Denial of Service AI outages or slowdowns
LLM05 Supply Chain Vulnerabilities Compromised data sources
LLM06 Sensitive Information Disclosure PII or secrets exposed via queries
LLM07 Insecure Plugin Design Backdoors through third-party integrations
LLM08 Excessive Agency Autonomous actions without oversight
LLM09 Overreliance Blind trust in AI output
LLM10 Model Theft Stolen models used by competitors

Prompt injection (LLM01) and data poisoning (LLM03) have the highest financial impact, but overreliance (LLM09) and data leaks (LLM06) create reputational and compliance risks.

Governance and regulation

AI security is not just a technical challenge — it requires leadership alignment.

Shared ownership: CISOs, data governance leads, and product teams must collaborate on secure-by-design principles and continuous model validation.

Regulatory shifts:

  • Canada’s Artificial Intelligence and Data Act (AIDA) was paused in January 2025.
  • Provinces such as British Columbia are moving ahead with local AI rules.
  • The EU AI Act enforces strict requirements for high-risk AI, including transparency and auditability. Non-compliance can result in fines up to seven per cent of global revenue.

These differences create a complex environment for global organizations.

Vendor risk management: Update third-party assessments to cover:

  • Data handling practices and retention policies
  • Right to audit vendors' AI processes
  • Incident response timeframes and obligations

A layered defence model

Defending AI requires coordinated preventive, detective, and responsive measures.

Preventive controls:

  • Deploy input/output filtering with NVIDIA NeMo Guardrails or similar tools.
  • Vet external data sources for RAG pipelines to prevent poisoned content.
  • Restrict AI agent permissions using least-privilege principles and human approval for sensitive actions.

Detective controls:

  • Continuously monitor model behaviour for anomalies such as sudden latency spikes or unexpected output drift.
  • Embed cryptographic watermarks to detect model theft.

Responsive controls:

  • Maintain a rollback strategy to revert compromised models quickly.
  • Communicate transparently with users during incidents to preserve trust.
  • Conduct regular red-team exercises to simulate attacks and refine defences.

What to do

  1. Identify all AI assets and dependencies within the first 90 days.
  2. Deploy filtering and least-privilege controls for every AI agent by six months.
  3. Run quarterly red-team exercises to identify emerging vulnerabilities.
  4. Formalize AI governance and integrate it into enterprise risk management.
  5. Update vendor risk frameworks to include AI-specific requirements.

Key takeaways

  • AI is now both a strategic enabler and a prime attack target.
  • Regulatory gaps require proactive, global governance alignment.
  • Phased, layered security is essential to defend AI systems at scale.

Updated: 2025-09-16 to reflect Canada’s regulatory pause and new attack examples.