AI safety and cybersecurity trackers show attack paths widening

At a glance

What this is: A July 13, 2026 AI safety and cybersecurity tracker that maps research topics to attack stages across prompt injection, model extraction, poisoning, and agentic manipulation.

Why it matters: It matters because identity, access, and trust controls now need to extend into AI systems, where compromise can occur through prompts, plugins, credentials, and model supply chains.

Context

AI security now spans both model behaviour and the surrounding control plane. This tracker groups research into attack paths such as prompt injection, insecure output handling, model theft, and data poisoning, which shows that failure modes are no longer confined to the model itself.

For identity and security teams, the important boundary is between a model that generates output and an AI system that can act, call tools, or consume credentials. Once AI is allowed to reach infrastructure, plugin surfaces, or external accounts, governance has to treat it as an access-bearing system rather than a standalone application.

Key questions

Q: What breaks when indirect prompt injection is not controlled in AI systems?

A: Indirect prompt injection breaks the assumption that retrieved content is safe to use as instruction material. Once malicious text enters the model context, the system may alter responses, leak data, or trigger tools with delegated permissions. The core failure is boundary collapse between data and directive, which turns ordinary content ingestion into an execution risk.

Q: Why do AI agents increase non-human identity risk?

A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission. That speed expands blast radius, shortens attacker dwell time, and makes weak delegation more dangerous. The remedy is tighter scoping, continuous verification, and strict separation between observation and execution privileges.

Q: How can security teams tell if AI output is becoming a security control gap?

A: A control gap appears when generated text, code, or commands are used without review in systems that can store data, execute actions, or change permissions. Signs include unvalidated prompts reaching automation, repeated sensitive disclosures, or model output driving operational changes. The test is whether downstream systems trust AI output more than they trust the original control gate.

Q: When should organisations apply agentic AI governance instead of basic LLM controls?

A: Organisations should apply agentic AI governance when the system can choose tools, call APIs, or act on behalf of a person or process. Basic LLM controls are not enough once the model can change state, because the risk is no longer only text generation. Governance has to cover permissions, tool scope, and delegated authority.

Technical breakdown

Prompt injection and input manipulation in AI systems

Prompt injection is the abuse of instructions embedded in prompts, retrieved content, or user inputs to steer model behaviour away from its intended policy. Direct attacks place malicious instructions in the chat or request itself, while indirect attacks hide them inside documents, web pages, or tool responses that the model later consumes. The security issue is not only output quality. It is control loss over decision-making, tool selection, and downstream actions when the model treats untrusted text as authority.

Practical implication: Treat every external input as untrusted policy material and isolate instruction data from content data.

Model extraction, leakage, and insecure output handling

Model extraction and sensitive information disclosure occur when an attacker elicits internal model details, training data fragments, system prompts, or other protected artefacts through repeated queries or poorly constrained outputs. Insecure output handling becomes a security issue when generated content is trusted by downstream systems without validation. That can turn a model into a leakage channel or an injection point, especially when outputs feed code, workflows, or retrieval layers.

Practical implication: Validate AI outputs before they enter workflows that can execute, store, or redistribute sensitive material.

Agentic manipulation, plugin compromise, and supply chain risk

Agentic systems expand the attack surface because they can select tools, execute actions, and inherit trust from connectors, plugins, or external APIs. Insecure plugin design, compromised dependencies, and model or data supply chain issues can let an attacker move from model influence to operational impact. The core risk is delegated authority. Once an agent can act on a user's behalf, compromise of its context, credentials, or toolchain can create real-world side effects.

Practical implication: Bind agent actions to scoped permissions, inventory external dependencies, and review every tool path that can alter state.

Threat narrative

Attacker objective: The attacker wants to turn AI trust into operational reach, using model influence to obtain credentials, manipulate outputs, or drive downstream misuse.

1. Entry begins with prompt injection, fake resources, phishing, or other input manipulation that reaches the model or its surrounding workflow.
2. Credential access or control follows when the attacker uses the model, plugin, or connected account to expose secrets, tokens, or authentication material.
3. Impact occurs when the compromised AI system is used to generate harmful output, modify real resources, or propagate abuse through trusted integrations.

Breaches seen in the wild

• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.
• Microsoft Azure OpenAI abuse by Storm-2139: Storm-2139 used API keys leaked by Microsoft customers to hijack Azure OpenAI, bypass safety guardrails and resell access to generate harmful content.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI governance is now an identity and access problem as much as a model problem. This tracker groups threats that move from prompt influence to control loss, which means the real risk boundary sits around credentials, tools, and delegated permissions. If an AI system can act, then its identity, privilege, and trust relationships become governance objects, not implementation details.

Prompt injection is the AI equivalent of untrusted input becoming trusted instruction. The article's taxonomy shows that direct and indirect manipulation are not edge cases but core attack paths across modern AI stacks. Practitioners should stop treating prompt safety as a content filter issue and start treating it as a control-plane integrity issue.

Model extraction, leakage, and insecure output handling form a single disclosure chain. Once a system can reveal hidden prompts, training fragments, or sensitive data, downstream workflows may amplify the damage by trusting the output. The governance gap is that many programmes separate model safety from data protection even though the exposure path crosses both.

Agentic systems create delegated authority debt. Every tool, plugin, and connector adds a trust path that can be abused if the model is manipulated or the supply chain is compromised. That makes agentic systems materially different from passive LLM use, because compromise can translate directly into state-changing actions.

AI safety taxonomies are becoming operationally useful only when they map to control domains. The tracker's structure aligns naturally to MITRE ATLAS and OWASP guidance because the threat classes already resemble familiar attack stages. That gives security teams a way to fold AI risk into existing governance without pretending model risk is separate from enterprise security.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Threat Modelling AI Agents

What this signals

AI governance debt is accumulating faster than most identity programmes can absorb. Asenion's taxonomy shows that the practical boundary is no longer whether a model is safe in isolation, but whether its prompts, tools, connectors, and credentials are governed as one system. Teams that still separate AI review from identity review will miss the control paths where compromise actually happens.

AI safety work is converging with existing threat models, especially where prompt injection, plugin compromise, and credential abuse intersect with MITRE ATLAS-style attack progression. That makes this a programme design issue, not a niche AI concern, and it argues for using control ownership that spans both the model and the delegated access layer.

Verification trust gap: organisations need to verify not just model outputs but the trust chain behind every action an agent takes. AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.

For practitioners

• Separate instructions from content Design AI workflows so system prompts, retrieved content, and user inputs are handled as distinct trust classes, with untrusted content unable to override policy instructions.
• Constrain agent permissions by task Limit tool use, connector scope, and token reach so an AI agent can only access the minimum accounts and actions needed for the current session or workflow.
• Inspect outputs before downstream execution Require validation on AI-generated text, code, and commands before those outputs are stored, executed, or passed into business systems that can change state.
• Inventory AI supply chain dependencies Track plugins, model providers, embedded components, and external services as part of the AI trust boundary so compromise in one layer does not become silent inherited risk.

Key takeaways

• AI safety taxonomies now map cleanly to access, integrity, and exfiltration risks, which means governance has to move beyond model-quality checks.
• Prompt injection, output leakage, and plugin compromise are separate labels for one broader problem when AI systems are allowed to act across tools and accounts.
• The most important control shift is to govern delegated authority, not just model behaviour, because agentic systems can turn influence into operational impact.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Agentic Manipulation: Agentic manipulation is the abuse of an AI system that can choose tools, take actions, or delegate work on behalf of a user or process. The security issue is not just bad output. It is the conversion of influence into real operational authority through credentials, connectors, or workflow trust.
• Model Extraction: Model extraction is the theft of model behaviour or parameters through repeated interactions, often via an exposed API. The attacker may not need direct file access if the interface leaks enough information through outputs, rate limits, or weak request controls.
• Insecure Output Handling: Insecure output handling happens when downstream systems trust LLM output without validation, encoding, or policy checks. Because model responses can be manipulated, this creates pathways to XSS, SSRF, privilege escalation, remote code execution, and other unsafe actions. The control failure is treating generated text as reliable application input.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners build controls for systems that act on behalf of users or workloads.