# AI Threat Awareness Program > Source: > Published: 2026-09-15 12:17:07+00:00 Six threats make up the current taxonomy. Four are vectors, how exposure is created. Two are impacts, what it costs when a vector succeeds. | ID | Threat | Type | What it is | | |---|---|---|---|---| | AI-01 | Shadow AI | Vector | Unsanctioned LLMs and agents used outside governance | | | AI-02 | Rogue Agent | Vector | A sanctioned agent given more autonomy than its task needs | | | AI-03 | Prompt Injection | Vector | Hidden instructions override the model's intended behavior | | | AI-04 | Model & Data Supply Chain | Vector | Unvetted models, training data, or plugins carrying hidden risk | | | AI-05 | Data Exfiltration | Impact (from AI-01/02/03) | Sensitive data leaves company control | | | AI-06 | Hallucination | Impact (from AI-04 & over-reliance) | Confident but false output acted on unverified | | Each threat below follows the same structure: what it is, how it typically plays out end to end, what to watch for, and what closes the gap. Employees use unsanctioned LLMs, agents, or local models outside IT and InfoSec governance. These tools inherit the user's personal-level access with no DLP coverage and no audit trail. Exploit chain Indicators • Outbound traffic to AI service domains from non-corporate accounts • DLP alerts flagging AI-related data egress • Unapproved browser extensions or local model runners on endpoints Remediation • Stand up a formal AI intake and sanctioning process • Block or allowlist AI domains at the proxy • Provide a sanctioned enterprise AI alternative • Apply DLP monitoring with no exemptions, sanctioned tools included A sanctioned AI agent is granted more tools, data access, or autonomy than its task requires, and acts on faulty output without a human check. Indicators • The agent invokes tools or APIs outside its expected scope • An irreversible action is taken with no approval step • A service account holds write or delete access where read-only would do Remediation • Grant least-privilege, per-user scoped credentials, not shared high-privilege accounts • Require human approval before high-impact or irreversible actions • Enforce authorization on the backend system, never trust the model's own judgment • Log all agent activity and rate-limit sensitive operations Instructions hidden in user input, or in content the model reads, such as a document, email, or web page, override the system's intended instructions. Exploit chain Indicators • Output tone or content shifts unexpectedly mid-task • The agent references instructions the user never gave it • An unusual tool call follows immediately after reading external content Remediation • Treat all ingested or retrieved content as untrusted data, never as instructions • Apply runtime guardrails to every agent, with no exceptions for trusted-looking sources • Keep the system prompt's privilege segregated from user- and content-supplied text • Red-team live prompts and agents on a recurring schedule Pretrained models, fine-tuning datasets, or plugins sourced from unvetted third parties can carry backdoors, poisoned data, or undisclosed license and IP exposure. Regulated or sensitive data leaves the organization's control through a prompt, an agent's tool call, or a vendor's retention or training policy. This is a common outcome of Shadow AI, Prompt Injection, and Rogue Agent behavior. Indicators • Sensitive terms surfacing in prompt or agent logs • A vendor without a zero-retention or no-training clause • Regulated data, PII, PHI, or source code, seen on an unmonitored AI channel Remediation • Apply content-aware DLP to every AI channel, sanctioned or not • Tie data classification directly to what may enter a prompt • Require zero-retention terms in every AI vendor contract • Redact or tokenize sensitive fields before submission where feasible The model produces confident but false or fabricated output, such as a citation, a figure, or a policy clause, and someone acts on it without verifying it. This is most common where training data quality is poor or where staff over-rely on AI output. Indicators • Unverifiable citations, figures, or policy clauses • Output that contradicts known source documents • No human review step before the content is used externally Remediation • Require human review for any external or high-stakes output • Require sourced, grounded answers over freeform generation where accuracy matters • Train staff on automation bias and the habit of verifying before acting