[et_pb_section fb_built=”1″ _builder_version=”4.16″ global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.27.8″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″]<\/p>\n
An AI system in production rarely consists of just a single component: LLM, RAG, and vector databases; function calling; agents orchestrated via MCP; and MLOps and model serving infrastructure.<\/p>\n
ving. Each added building block expands the available attack surface, and most of the incidents documented in 2025\u20132026 occur precisely in the interfaces between these building blocks, rather than in the language model itself. This guide covers five architectural building blocks in the order in which they are typically stacked, identifying the risk vector(s) specifically associated with each one. <\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
The language model itself is the most mature component from a security perspective, precisely because it is the focus of the most research attention. Threeattack vectors target it directly.Prompt injection<\/em><\/a> inserts malicious instructions into the input processed by the model, either directly or via a document being accessed; this is currently the most well-documented attack vector, with the majority of production deployments being exposed to it in one way or another. Jailbreak aims <\/a>to bypass alignment safeguards to generate content that would normally be rejected. System prompt leakage<\/a> targets internal instructions that configure an application\u2019s behavior; extracting these can reveal business logic or facilitate a more targeted attack. <\/p>\n <\/p>\n These three vectors have one thing in common: there is no foolproof defense against them; the probabilistic nature of an LLM makes protection a matter of reducing the attack surface and continuous detection rather than complete elimination.<\/p>\n <\/p>\n <\/p>\n <\/p>\n The RAG enriches a model\u2019s responses with documents retrieved from a vector database at the time of the query\u2014a critical component: these are often copies of data that is already sensitive elsewhere, with historically weaker protection. The associated risk, known as RAG poisoning<\/a>, involves injecting malicious documents into this database: recent research shows that even a very small number of poisoned documents is sufficient to significantly influence the generated responses, even within an index containing several million legitimate documents. Any database fed by ungoverned sources (customer tickets, internal wikis, scraped content) must be treated as a full-fledged channel for indirect injection. <\/p>\n <\/p>\n Encryption at rest and in transit, as well as aligning the retention period for indexed documents with that of the original sources, remain basic measures that are often overlooked during the prototyping phase.<\/p>\n <\/p>\n <\/p>\n <\/p>\n Function calling<\/a> allows a model to act beyond the text; the MCP protocol standardizes this connection to tools. The most fundamental risk principle can be summed up in one sentence: an AI agent<\/a> acts within its own permissions, and any successful manipulation\u2014such as an indirect prompt injection hidden within a viewed document\u2014causes it to inherit that elevation of privileges. This is why managing AI access and identities<\/a> becomes a security component in its own right as soon as an agent has tools at its disposal. A CVE documented in early 2026 (CVE-2026-4270 in awslabs.aws<\/a>) on a widely used MCP server illustrates this scenario: a flaw in file access restrictions exposed arbitrary local content without any compromise of the model. <\/p>\n <\/p>\n Autonomous agents pose this risk and add to it the risk of sub-goal hijacking, as well as a supply chain risk specific to their ecosystem: In early 2026, a landmark incident<\/a> illustrated this risk when Openclaw\u2019s Clawhub marketplace was targeted by a campaign involving malicious \u201cskills.\u201d Researchers identified 341 malicious skills<\/strong> out of 2,857 analyzed, several of which were used to install or distribute the Atomic macOS Stealer<\/strong> (AMOS)<\/strong> by masquerading as legitimate tools and exploiting the trust of users who had installed these extensions. Upstream from these components, model poisoning<\/a> targets the training or fine-tuning process itself to introduce hidden behavior into the final model. <\/p>\n <\/p>\n <\/p>\n <\/p>\n Beneath the application building blocks lie MLOps, model serving, and\u2014for sovereignty\u2014the self-hosted LLM. Two approaches target the model once it has been trained: model extraction<\/a>, which reconstructs an approximation of the model through repeated queries to its API\u2014posing an intellectual property risk\u2014and model inversion, which reconstructs information about the training data from the responses\u2014posing a direct risk to privacy if that data were sensitive. <\/p>\n <\/p>\n A more recent vector affects the development pipeline associated with these building blocks: slopsquatting<\/a> exploits the fact that a code-generating template sometimes references package names that do not exist <\/p>\n <\/p>\n <\/p>\n Two types of attacks do not target any internal technical components: deepfakes and AI-assisted phishing use AI as a weapon against the company from the outside, without requiring any compromise of its information system. Finally, data exfiltration cuts across all the previous components (direct entry, a generated response revealing confidential content, or an agent with excessive access), making it less of an isolated vector and more of a potential consequence of any of the poorly secured components listed above. <\/p>\n <\/p>\n <\/p>\n <\/p>\nRAG and Vector Databases: RAG Poisoning<\/h2>\n
MCP, function calling, and agents: inherited permissions and upstream poisoning<\/h2>\n
Infrastructure and Model: Extraction, Inversion, and Slopsquatting<\/h2>\n
(20% of <\/strong>generations, according to a study conducted by three universities<\/a>), which an attacker then registers in a public registry to trap developers.<\/p>\nDeepfakes, AI-powered phishing, and data exfiltration: when the target is the architecture itself<\/h2>\n
A Single Framework for Prioritization: OWASP LLM Top 10<\/h2>\n