AI Security 101: Mapping the AI Attack Surface
Summary
An overview of AI security risks across data, models, pipelines, APIs and shadow AI, with practical steps for reducing exposure and examples of incidents Wiz says it uncovered or observed.
Key points
- AI attack surfaces span training data, model artifacts, AI pipelines, APIs and untracked or unsanctioned AI use.
- The article identifies prompt injection, training-data leakage, model poisoning and untracked model usage as risks layered on top of traditional cloud security concerns.
- Wiz says its researchers uncovered a misconfigured SAS token that exposed 38 TB of private Microsoft data, including training files, internal documentation and credentials.
- Wiz says it discovered a vulnerability in Bing AI features that let attackers manipulate model output through prompt injection.
- The article recommends mapping AI use, auditing training data, limiting permissions, monitoring AI endpoints and coordinating security ownership across teams.
- It describes the Storm-0558 breach as a non-AI-specific example of how compromised authentication keys can affect large-scale systems.
Article Details
- Topic
- AI attack surface risks and security practices