CD Consulting R&D

KB-AI · Entry 4 · Published 2026-10-15 · Version 1

Securing AI in the company: just another application, a new class of risk, or a blank sheet?

Do the existing security rules suffice for AI, or must security be rethought? A position note that reads some 160 public sources, finds the baseline mandatory and often missing, names four genuinely new risks, measures what help from AI is proven to deliver, and ends with the Belgian and European rules and twenty-two measures by priority.

If you run or advise an organisation that uses AI tools, or are about to, this is where the existing security rules stop, what a language model changes that no firewall sees, and the six steps that cost almost nothing.

Position note · about 160 public sources (official frameworks, cybersecurity authorities, standards bodies, vendors, researchers, documented incidents) consulted on 15 October 2026 · every figure sourced · reserves of method declared

Contents

1. 1. The answer on one page
2. 2. What the question presupposes, and what the sources say
3. 3. What the existing rules cover, and where they stop
4. 4. The new threats, and why they are new
5. 5. The defences: why the problem is said to be unsolved, and what works anyway
6. 6. "With the help of AI": what is proven, what is not
7. 7. The Belgian and European framework, in four dates
8. 8. Ten theses for the discussion
9. 9. Fifteen incidents, and what a classical control could have done
10. 10. Twenty-two measures for an ordinary company, by priority
11. 11. Limits of this note
12. 12. Sources

1. The answer on one page

Neither. None of the roughly 160 sources read for this note holds that the existing security rules suffice; none proposes to start again from a blank sheet. The common position of the authorities (NIST, ENISA, the UK NCSC, CISA, the French ANSSI, the Belgian CCB), the standards bodies (ISO/IEC 27090, 42001, 23894), the European legislator (AI Act, articles 9 and 15) and the large vendors (Google, Microsoft, Anthropic, OpenAI) fits in three propositions.

The classical baseline remains mandatory, and it is often missing. Access control, network segmentation, patching, secrets management, logging, backups, supplier management: all of it applies to AI as to any software stack, and that is where breaches happen first. According to IBM's 2025 breach study, 97 % of organisations that suffered a breach involving an AI system had no access controls on that system at all [S1]. A good share of the "AI incidents" of 2023-2026 are ordinary defects of a young stack deployed by data teams outside the security circuit: dashboards without authentication, exposed databases, over-broad tokens, unsafe deserialisation, unapplied patches.

AI nevertheless adds a class of risk that those controls do not see. A language model does not distinguish an instruction from a datum: any text it reads (an e-mail, a web page, a ticket, the description of a tool) can steer it. This is prompt injection, which the UK NCSC judges may "never be totally mitigated", for want of an equivalent of the parameterised queries that solved SQL injection [S6]. In the EchoLeak case (Microsoft 365 Copilot, 2025), anti-spam, data-loss prevention, content-security policy and an anti-injection classifier were all in place: the exfiltration happened without a click [S19]. To this are added persistence (an injection or a poisoning survives in a memory, a document index, model weights), agency (an agent acts with its user's rights, and for it an instruction in natural language is not a control), and liability (the company answers for what its chatbot says: Air Canada, 2024 [S28]).

"Rethinking" does not mean "blank sheet"; it means changing how one looks at one component. The most advanced approaches (CaMeL at Google DeepMind, Meta's "rule of two", Simon Willison's "lethal trifecta", agent sandboxes, agent identities) are returns to fundamentals applied to a new component: separate control from data, give the agent only the privileges of the least trusted source it reads, confine, log actions, have a human confirm what is irreversible [S34] [S37] [S17]. The real novelty of governance is having to treat the model as an untrusted user inside the system, and to accept a residual risk explicitly; if the use case cannot tolerate it, a language model may not be the right choice for it [S6].

As for "help from AI": it is real on a few measured uses (phishing triage, script analysis and incident summaries, vulnerability research with human validation, red-teaming one's own deployments), but what is proven is narrower than what is sold: no independent study of commercial security copilots, "AI firewalls" bypassed more than 90 % of the time by adaptive attackers, and an automation bias measured among analysts [S31] [S49]. For an ordinary company the first "help from AI" to fund is, paradoxically, patch management: the attacker benefits first from the acceleration, and the delay between disclosure and exploitation is now counted in days [S48].

For a Belgian SME, the answer fits in six near-free steps, then a dozen measures within the year (section 10): inventory the uses, classify them under the AI Act, publish a one-page charter, provide an approved tool under a professional account with training disabled, hold a documented "AI literacy" session (an obligation under article 4 since 2 February 2025 [S52]), and bring the baseline to CyberFundamentals Small or Basic, which is the CCB's explicit answer to offensive AI [S5].

2. What the question presupposes, and what the sources say

The question opposes two hypotheses: AI is "an application like any other", or it is "a new source of risk" that would require security to be "rethought". The corpus shows that both camps exist, that they are held by serious people, and that they concede each other the essential.

The "it is software" camp. CISA wrote it in August 2023: "AI is a type of software system", and the Secure by Design principle applies without exception; adversarial attacks only matter once the surrounding system is already secure, because the attacker takes the cheapest path, which most often remains a conventional vulnerability in the software around the model [S2]. The joint guide of seven agencies (NSA, CISA, FBI and their Australian, Canadian, New Zealand and British counterparts, April 2024): "the security best practices and requirements for IT environments apply to AI systems, too" [S3]. NVIDIA's AI Red Team (2025) brings field evidence: the three classes of flaw observed in audits (execution of generated code, failing access control on the sources of a retrieval system, rendering of active content that exfiltrates) are ordinary application-security mistakes [S4]. The Belgian CCB, in its article of 29 September 2026 on AI that "accelerates and amplifies" threats, answers with CyberFundamentals and faster patching: nothing specific to AI [S5]. And the Belgian NIS2 Act (26 April 2024, in force since 18 October 2024) contains no AI-specific rule: an AI system is an asset like any other, subject to the general measures [S55].

The "new class of risk" camp. It is held first by authorities with nothing to sell. The UK NCSC, 8 December 2025: large language models "simply do not enforce a security boundary between instructions and data inside a prompt"; likening prompt injection to SQL injection is dangerous, because the latter was solved by separating data from instructions and no equivalent exists for the former; "it's very possible that prompt injection attacks may never be totally mitigated" [S6]. OWASP (Top 10 for LLM applications, 2025): "it is unclear if there are fool-proof methods of prevention" [S7]. Microsoft (taxonomy of agent failure modes, April 2025) documents failure modes that are novel and not observed in non-agentic generative AI systems: memory poisoning, failures between agents [S8]. The French CERT-FR (April 2026) draws a radical practical consequence: no autonomous agents on workstations until they are proven, mandatory human validation before any action with side effects, and the instructions placed in prompts are not sufficient [S9].

What both camps concede. No source defends the blank sheet. The most "disruptive" framework (Forrester's AEGIS, "securing intent rather than securing systems", 2025) is structured in six domains which are governance, identity, data security, application security, threat management and zero trust [S15]. The Cloud Security Alliance extends its cloud controls matrix (243 AI controls) instead of replacing it [S14]. ENISA (2023) formalises three layers of which the first is "cybersecurity foundations" [S13]. Conversely, no "classical" source denies injection: CISA acknowledges that adversarial inputs differ in practice from classical input-validation flaws [S2]. ISO/IEC 27090, whose publication is announced for October 2026, settles the question in its official abstract: established cybersecurity practices "remain essential", but AI "introduces security challenges that conventional cybersecurity measures alone may not fully address" [S10]. ANSSI says it in French: while many security measures apply, AI systems present specific vulnerabilities (our translation) [S11].

The most precise formulation is Google's, in its approach to agent security (May 2025): "Traditional security paradigms alone are insufficient", but a security based purely on the model's reasoning is insufficient too; hence a hybrid defence in depth, in which the deterministic classical controls (identities, privileges, confinement, logging) form the bounds the model cannot cross even when fooled, and the model-based defences (classifiers, safety training) reduce the probability without ever guaranteeing it [S12].

3. What the existing rules cover, and where they stop

The table condenses a mapping of fourteen families of controls established from the sources of section 2 [S1] [S3] [S4] [S6] [S7] [S12] [S17].

Overall reading: every line starts with "yes". The classical control is never replaced; it changes in nature because the subject that exercises or undergoes it, the model, is what the NCSC calls an inherently confusable deputy, which reads everything and obeys everything [S6].

4. The new threats, and why they are new

Twenty families of threat and thirty-three dated incidents (2019 to April 2026) were classified for this note, indicating for each whether a classical control would have sufficed (section 9 gives fifteen of them). Four novelties stand out.

Prompt injection, above all indirect. Named by Simon Willison in September 2022, formalised by Greshake and co-authors in February 2023 ("LLM-integrated applications blur the line between data and instructions" [S16]), it consists in placing an instruction in a content the AI will read later: web page, e-mail, shared document, support ticket, description of a tool. The attacker needs no access; it suffices that its datum be read. Antivirus, endpoint detection, identity management see nothing: the model acts with the user's legitimate rights. The Cloud Security Alliance observes in April 2026 that indirect injection "has crossed the line from proof-of-concept to live exploitation" [S18].

Persistence. An injection or a poisoning survives the session and contaminates the following decisions: the persistent memory of an assistant (ChatGPT, "SpAIware", 2024 [S20]), the rules files of coding assistants containing invisible characters (Cursor, Copilot, 2025 [S21]), the document index of a retrieval system (five injected texts in a base of millions of documents suffice to dictate 90 % of the answers to a question, PoisonedRAG, 2024 [S22]), the weights of a model (250 poisoned documents suffice whatever the model size, Anthropic, UK AISI and the Alan Turing Institute, October 2025 [S23]). Classical controls have no inventory of these states: one scans files, not "memories".

Agency. Replit (July 2025: an agent wipes a production database despite a code freeze and an instruction to make no change without approval [S24]), OpenClaw (February 2026: an agent deletes hundreds of e-mails while ignoring stop orders [S25]), GitHub's MCP server (May 2025: an agent reads private repositories and publishes them, with no permission violated [S26]) show that the instruction in natural language is not a control and that human confirmation is neutralised by approval fatigue ("always allow"). OWASP codified this passage in a Top 10 for agentic applications (December 2025): goal hijacking, tool misuse, privilege abuse, memory poisoning, rogue agents [S27].

Truth and liability. No security control checks that an answer is true. Air Canada was condemned (February 2024) for a fare invented by its chatbot; the tribunal held that "it makes no difference whether the information comes from a static page or a chatbot" [S28]. It is a legal risk carried by the technology, not by a flaw.

And what is not new, but worsens: the data leak by usage (Samsung, 2023: source code pasted into ChatGPT [S66]) is a matter of usage policy and DLP; CEO fraud by cloned voice or forged video (243,000 dollars in 2019 [S67]; 25.6 million dollars at Arup in Hong Kong in 2024, through an entirely forged video conference [S29]) is a matter of out-of-band dual verification, twenty years old. What changes is qualitative on one point: the proof "I saw it and heard it" no longer has any value as a control.

The signal of 2026. Most AI incidents have no CVE; of the eight incidents of the first quarter of 2026 listed by OWASP, the only one with a CVE is the most classical (Flowise, remote code execution on twelve to fifteen thousand instances left unpatched seven months after the fix) [S30]. In other words, traditional vulnerability management, on its own, will not see the others coming.

5. The defences: why the problem is said to be unsolved, and what works anyway

Filtering defences do not hold against an attacker who iterates. Twelve recent defences against injection, which announced an attack success rate close to zero, were bypassed more than 90 % of the time by researchers from OpenAI, Anthropic, Google DeepMind and ETH Zurich ("The Attacker Moves Second", to appear at USENIX Security 2026) [S31]. The published scores of injection classifiers are inflated by 8 to 16 points by dataset artefacts (2026) [S32]. NIST, through Apostol Vassilev: "There are theoretical problems with securing AI algorithms that simply haven't been solved yet. If anyone says differently, they are selling snake oil" [S33]. The NCSC recommends scepticism towards products that claim to "stop" injection [S6]. No independent efficacy test was found for the commercial "AI firewalls".

The only defences with guarantees give up the general-purpose agent. CaMeL (Google DeepMind and ETH, March 2025) compiles the trusted request into restricted code and tracks the provenance of every datum up to the tool call: 77 % of the tasks of a benchmark solved with provable security, against 84 % without defence [S34]; Simon Willison sees in it "the first mitigation for prompt injection I've seen that claims to provide strong guarantees" [S35]. Six design patterns (fourteen authors from IBM, Google, Microsoft, ETH, June 2025) start from the same principle: "once an LLM agent has ingested untrusted input, it must be constrained so that it is impossible for that input to trigger any consequential actions" [S36]. Meta formulates a "rule of two" (October 2025): an agent does not combine, within one session, more than two of the three properties "processes untrusted inputs", "has access to sensitive data", "can change state or communicate externally" [S37]. These are architectural constraints, imposed outside the model.

What converges, in practice, between the NCSC, Google, OWASP and Microsoft [S6] [S12] [S27] [S8]:

1. Authorisation decisions are taken outside the model, by deterministic code, with a privilege aligned on the current task; an agent that reads the content of a source has only that source's privileges.
2. Irreversible actions require human confirmation; the agent's plan is observable before execution; tool calls are logged.
3. The residual risk of injection is accepted explicitly by the risk owner. If the use case does not tolerate it, no language model in the loop.
4. The lethal trifecta is deliberately broken: no agent that, at once, reads external content, has access to private data and can communicate outwards.

6. "With the help of AI": what is proven, what is not

Proven. Agents find and fix real vulnerabilities: at the final of DARPA's AIxCC competition (August 2025), the seven systems found 86 % of the 63 injected flaws, fixed 68 %, and discovered 18 real, unplanted flaws, at about 152 dollars per task; the systems are published as open source [S38]. Big Sleep (Google) found a flaw in SQLite before any public release (2024) [S39]; CodeMender (Google DeepMind) sent 72 fixes upstream to open-source projects (2025), each reviewed by a human [S40]. On phishing detection, a language model recognises fraudulent intent well above 90 % with few false positives (Harvard, 2024) [S41]. On incident analysis, the only randomised trial (Microsoft, on its own product) gives analysts 22 % faster and 7 % more accurate, the real gain being concentrated on script analysis [S42].

Not proven, or not yet. "Cold" detection of vulnerabilities by a model alone remains weak: on a cleaned benchmark (PrimeVul, ICSE 2025), a code model falls from 68 % to 3 % F1 score, and GPT-4 performs "akin to random guessing in the most stringent settings" [S43]; the successes come from tooled agents (compilation, execution, fuzzing), from a concrete starting point (87 % exploitation of a known flaw with its description, 7 % without [S44]) and from a human validation that every serious actor claims. The efficacy of commercial security copilots: a vendor's "98 %" is a rate of agreement with its own analysts, the "40 hours saved" the product of an estimated time [S45]; no independent study was found for the others. The announced capabilities of the latest generation of models in vulnerability research ("thousands of zero-days", 2026) are, to date, unverifiable from outside [S46].

The asymmetry. AI-generated phishing obtains the same click rate as that of human experts (54 %), at a fraction of the cost (Harvard, 2024; taken up by Microsoft and ENISA) [S41]. Intrusion campaigns orchestrated by an agent have been documented (Anthropic, 2025: some thirty targets, 80 to 90 % of tactical operations executed by the AI), with a useful admission: the model "occasionally hallucinated credentials" and overstated its findings [S47]. The NCSC judges it almost certain that AI will further shorten the delay between disclosure and exploitation, already of a few days [S48]. Verizon and OpenAI converge: AI is, for now, an efficiency multiplier, not an unprecedented capability [S64].

The risks of relying on it. Automation bias is measured in security operations centres (696 analysts, 2026): automation displaces attention and reduces the monitoring of automated results; the only demonstrated mitigation is systematic verification procedures [S49]. AI-generated code introduces a weakness in about 45 % of the tasks tested (Veracode, 2025) [S50]. The curl project closed its bug-bounty programme in February 2026 under the flood of AI-generated, hallucinated reports [S51].

What this means for an ordinary company. "With the help of AI" is realistic for: phishing triage with a human on edge cases; script analysis and incident summaries; assisted code review, with sandboxed execution and human reading; red-teaming one's own AI deployments before going live, with open tools. To avoid without one's own measurement: closing alerts automatically on the strength of a vendor figure; deploying an "AI firewall" as the only barrier; letting an agent combine data, external inputs and the capacity to act. And to budget: human verification time, a pilot on one's own data before any purchase (measure false negatives, not agreement), and patch management, the first "help from AI" since the attacker profits from it first.

7. The Belgian and European framework, in four dates

Three facts of context: 34.5 % of Belgian companies with ten or more employees used at least one AI technology in 2025 (24.7 % in 2024; 76.4 % of large ones, 28.8 % of small ones), against 20 % in the Union (Statbel and Eurostat via the FPS Economy) [S58]; the CCB states that it has not yet seen an attack carried out by AI agents (29 September 2026) but presumes automation [S5]; no Belgian doctrine on AI security was found (the CCB relies on the AI Act and CyberFundamentals; its Frontier AI Hub announces recommendations for the end of 2026), and no "AI security for SMEs" checklist at the federations. A French-speaking Belgian company therefore relies on ENISA, the AI Act, CyberFundamentals, the Data Protection Authority and, for the technical side, on ANSSI and the CNIL.

8. Ten theses for the discussion

1. AI is not an application like any other, but it is installed on a stack like the others, and that is where breaches begin: 97 % of AI breaches without AI access control [S1].
2. The boundary between data and instructions, on which all application security has rested since parameterised queries, does not exist in a language model. That is the novelty of substance; everything else follows from it [S6] [S16].
3. Prompt injection has no patch. It is managed as a permanent residual risk, by architecture: the agent's privileges brought down to those of the least trusted source, decisions taken outside the model, human confirmation of irreversible actions [S6] [S36].
4. An instruction in natural language is not a control. "Do nothing without my approval" stopped neither Replit nor OpenClaw [S24] [S25].
5. The deputy reads everything and obeys everything. An agent that combines private data, untrusted content and an outbound channel is exploitable; one breaks the trifecta, one does not filter it [S17] [S37].
6. Persistence changes the inventory. Memories, document indexes, rules files and model weights are assets to inventory, protect and purge [S20] [S21] [S22] [S23].
7. Audiovisual proof no longer has any value as a control. The parade against CEO fraud remains out-of-band dual verification [S29].
8. The company answers for what its AI says. A chatbot is a page of the site, not "a separate legal entity" [S28].
9. "With the help of AI" is realistic on few measured things, and the first is patch management, because the attacker moves faster than the defender [S48].
10. Risks are managed in parallel with opportunities, not as a precondition (Cigref, our translation): neither blockage, nor blank sheet; inventory, charter, approved tool, documented training, CyberFundamentals baseline [S63].

9. Fifteen incidents, and what a classical control could have done

10. Twenty-two measures for an ordinary company, by priority

P1: weeks 1 to 4, near-zero cost. P2: within three months. P3: within the year. P4: depending on exposure. The sources are those of sections 2 to 7, plus the NIST AI RMF Playbook [S59], the CSA note on shadow AI [S60], the OWASP governance checklist [S61] and ANSSI's recommendations [S62].

P1 — See and frame

1. Inventory all AI uses: SaaS tools, embedded AI functions (office suites, CRM), browser extensions, personal accounts, scripts and agents; purpose, data, supplier, owner [S59] [S60].
2. Determine one's role under the AI Act (deployer in most cases) and classify each use: prohibited, high-risk, transparency, minimal (FPS Economy pathway) [S58].
3. Publish a one- to two-page usage charter: authorised tools, data forbidden in prompts, human validation, transparency towards customers, incident reporting, annual review; communicate it actively [S63].
4. Provide an approved generative-AI tool under a professional account (no-training clause, processing agreement) rather than forbidding [S60].
5. Disable by default training on one's data and history in the authorised tools [S57].
6. Hold a first "AI literacy" session (article 4): hallucinations, injection, data never to enter, phishing and deepfakes; record attendance [S52].

P2 — Harden the baseline

1. Bring the baseline to CyberFundamentals Small or Basic: MFA everywhere, tested backups, fast patching, endpoint detection, account management [S5].
2. Shorten the patching delay on what is exposed [S5] [S48].
3. Adapt phishing awareness: spelling mistakes are no longer a signal; urgency, requests for codes, forged voices [S41].
4. Establish a data × tools matrix (public, internal, confidential, restricted) [S60].
5. Review AI suppliers' contracts: training on my data, retention, sub-processors and location, GDPR article 28 agreement, incident notification, certifications, model documentation, AI Act and CRA conformity; for a structuring purchase, the CSA's AI-CAIQ questionnaire [S14] [S56].
6. Integrate AI into the incident-response plan: data pasted into a public tool, unwanted action by an agent, leak at a supplier; GDPR (72 h) and NIS2 qualification [S59].

P3 — Structure

1. Appoint an AI lead or a small committee (management, IT, DPO, business): inventory, validation of new uses, annual review of the charter [S59] [S61].
2. Formalise an evaluation grid for use cases before deployment: purpose, data, AI Act risk, legal basis, impact assessment, human control, reversibility, supplier [S56].
3. Log the uses of company tools; review access; audit the presence of unauthorised AI [S1].
4. Detect shadow AI proportionately: DNS and proxy logs, browser extensions; a broker for the larger ones [S60].
5. Treat coding assistants as a special case: code review, secrets, licences, dependencies [S62] [S50].
6. Check insurance cover: AI exclusions or endorsements in liability, cyber and professional policies.
7. Human control and transparency for uses with impact (recruitment, evaluation, customer decisions); information of workers [S54] [S57].

P4 — Depending on exposure

1. NIS2 entity: AI systems and suppliers in the risk analysis and supply-chain management; CyberFundamentals label before 18 April 2027 (essential entities) [S55].
2. Use of agents: own identity per agent with an owner, short task-limited tokens, read/write separation, tool allow-list, readable logs of every action, human approval of consequential actions, sandbox for local agents; never combine untrusted content, sensitive data and the capacity to act in one session [S27] [S37] [S9].
3. High risk or internal development: full programme (NIST AI RMF or ISO/IEC 42001), tests, red-teaming, model cards, impact assessments; deadline of 2 December 2027 [S59] [S65] [S53].

11. Limits of this note

Several sites were inaccessible to the reading tools on 15 October 2026 (CNIL, ISO, the official MITRE ATLAS site, some OpenAI and press pages); their content is then cited through a secondary source, signalled in the source list. The figures on shadow AI come essentially from vendors of data-loss-prevention products: they are cited with that reserve. The capabilities announced by model vendors are reported as statements, not as measurements, wherever no independent verification exists. The incident table relies on primary sources or specialised press for each line; the thirty-three incidents analysed and the twenty families of threat classified for this note are summarised here, not reproduced. Quotations from French sources are our translation.

12. Sources

All sources were consulted on 15 October 2026 unless stated otherwise.

1. S1 Official (vendor study, press release). IBM, "IBM Report: 13% of Organizations Reported Breaches of AI Models or Applications, 97% of Which Reported Lacking Proper AI Access Controls", 30 July 2025. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
2. S2 Official (government). CISA, Christine Lai and Jonathan Spring, "Software Must Be Secure by Design, and Artificial Intelligence Is No Exception", 18 August 2023. https://www.cisa.gov/news-events/news/software-must-be-secure-design-and-artificial-intelligence-no-exception
3. S3 Official (joint guidance). NSA AISC, CISA, FBI, ASD ACSC, CCCS, NCSC-NZ, NCSC-UK, Deploying AI Systems Securely, 15 April 2024. https://www.cisa.gov/news-events/alerts/2024/04/15/joint-guidance-deploying-ai-systems-securely
4. S4 Vendor (research blog). NVIDIA AI Red Team, "Practical LLM Security Advice from the NVIDIA AI Red Team", 2025. https://developer.nvidia.com/blog/practical-llm-security-advice-from-the-nvidia-ai-red-team/
5. S5 Official (government). Centre for Cybersecurity Belgium, "AI accelerates and amplifies cyber threats: strengthen your basic security now", 29 September 2026. https://ccb.belgium.be/news/ai-accelerates-and-amplifies-cyber-threats-strengthen-your-basic-security-now
6. S6 Official (government). UK National Cyber Security Centre, David C., "Prompt injection is not SQL injection (it may be worse)", 8 December 2025. https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection
7. S7 Official (standards community). OWASP, LLM01:2025 Prompt Injection, Top 10 for LLM Applications 2025. https://genai.owasp.org/llmrisk/llm01-prompt-injection/
8. S8 Vendor (white paper). Microsoft AI Red Team, Taxonomy of Failure Modes in Agentic AI Systems, 24 April 2025. https://www.microsoft.com/en-us/security/blog/2025/04/24/new-whitepaper-outlines-the-taxonomy-of-failure-modes-in-ai-agents/
9. S9 Official (government). CERT-FR (ANSSI), CERTFR-2026-ACT-016 — Agents IA autonomes sur postes de travail [Autonomous AI agents on workstations], 13 April 2026. https://cert.cyber.gouv.fr/actualite/CERTFR-2026-ACT-016/
10. S10 Official (standards body). ISO/IEC JTC 1/SC 27, ISO/IEC 27090 — Cybersecurity — Artificial intelligence — Guidance for addressing security threats to artificial intelligence systems, official abstract, stage 60.00 at 19 August 2026. https://committee.iso.org/standard/56581.html
11. S11 Official (government). ANSSI, "Intelligence artificielle" [Artificial intelligence], cyber.gouv.fr, 2026. https://cyber.gouv.fr/enjeux-technologiques/intelligence-artificielle/
12. S12 Vendor (white paper). Google, An Introduction to Google's Approach for Secure AI Agents, May 2025. https://services.google.com/fh/files/misc/google_approach_for_secure_ai_agents.pdf
13. S13 Official (EU agency). ENISA, Multilayer Framework for Good Cybersecurity Practices for AI, 7 June 2023. https://www.enisa.europa.eu/publications/multilayer-framework-good-cybersecurity-practices-ai
14. S14 Industry body. Cloud Security Alliance, AI Controls Matrix (v1.1), 2025. https://cloudsecurityalliance.org/artifacts/ai-controls-matrix
15. S15 Press (trade). IT Brief, "Forrester launches AEGIS to help CISOs secure agentic AI systems", August 2025 (Forrester report not open access). https://itbrief.co.uk/story/forrester-launches-aegis-to-help-cisos-secure-agentic-ai-systems
16. S16 Research (preprint, later AISec 2023). Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz and Mario Fritz, Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection, arXiv:2302.12173, 23 February 2023. https://arxiv.org/abs/2302.12173
17. S17 Research (practitioner blog). Simon Willison, "The lethal trifecta for AI agents", 16 June 2025. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
18. S18 Industry body (research note). Cloud Security Alliance, Indirect Prompt Injection in the Wild, 26 April 2026. https://labs.cloudsecurityalliance.org/research/csa-research-note-indirect-prompt-injection-in-the-wild-2026/
19. S19 Press (specialised). BleepingComputer, "Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot" (EchoLeak, CVE-2025-32711), 11 June 2025. https://www.bleepingcomputer.com/news/security/zero-click-ai-data-leak-flaw-uncovered-in-microsoft-365-copilot/
20. S20 Research (practitioner blog). Johann Rehberger, "SpAIware: ChatGPT macOS app persistent data exfiltration", Embrace the Red, 20 September 2024. https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration/
21. S21 Vendor (research). Pillar Security, "New vulnerability in GitHub Copilot and Cursor: how hackers can weaponize code agents" (Rules File Backdoor), 18 March 2025. https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents
22. S22 Research (USENIX Security 2025). Wei Zou, Runpeng Geng, Binghui Wang and Jinyuan Jia, PoisonedRAG, arXiv:2402.07867, 12 February 2024. https://arxiv.org/abs/2402.07867
23. S23 Vendor (research). Anthropic, UK AI Security Institute and the Alan Turing Institute, "A small number of samples can poison LLMs of any size", 9 October 2025. https://www.anthropic.com/research/small-samples-poison
24. S24 Press. Fortune, "AI-powered coding tool wiped out a software company's database in 'catastrophic failure'", 23 July 2025. https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/
25. S25 Official (OECD AI incidents monitor). OECD.AI, incident of 23 February 2026 (OpenClaw agent deleting e-mails). https://oecd.ai/en/incidents/2026-02-23-d55b
26. S26 Vendor (research). Invariant Labs, "GitHub MCP exploited: accessing private repositories via MCP", 26 May 2025. https://invariantlabs.ai/blog/mcp-github-vulnerability
27. S27 Official (standards community). OWASP, Top 10 for Agentic Applications for 2026, 9 December 2025. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
28. S28 Press (regional), reporting the decision Moffatt v. Air Canada, Civil Resolution Tribunal (British Columbia), 14 February 2024. Daily Hive, "Air Canada chatbot decision". https://dailyhive.com/canada/air-canada-chatbot-decision
29. S29 Press. Fortune Europe, "Arup confirms it was the victim of a $25 million deepfake scam", 17 May 2024. https://fortune.com/europe/2024/05/17/arup-deepfake-fraud-scam-victim-hong-kong-25-million-cfo/
30. S30 Official (standards community). OWASP GenAI Security Project, Exploit Round-up Report Q1 2026, 14 April 2026. https://genai.owasp.org/2026/04/14/owasp-genai-exploit-round-up-report-q1-2026/
31. S31 Research (USENIX Security 2026). Milad Nasr, Nicholas Carlini et al., The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections, arXiv:2510.09023, 10 October 2025. https://arxiv.org/abs/2510.09023
32. S32 Research (preprint, AIWILD workshop at ICLR 2026). Fomin, When Benchmarks Lie, arXiv:2602.14161, 15 February 2026. https://arxiv.org/abs/2602.14161
33. S33 Press (specialised), quoting NIST's Apostol Vassilev. SecurityWeek, "NIST: No Silver Bullet Against Adversarial Machine Learning Attacks", 8 January 2024. https://www.securityweek.com/nist-no-silver-bullet-against-adversarial-machine-learning-attacks/
34. S34 Research (preprint). Edoardo Debenedetti, Ilia Shumailov, Florian Tramèr et al., Defeating Prompt Injections by Design (CaMeL), arXiv:2503.18813, 24 March 2025. https://arxiv.org/abs/2503.18813
35. S35 Research (practitioner blog). Simon Willison, "CaMeL offers a promising new direction for mitigating prompt injection attacks", 11 April 2025. https://simonwillison.net/2025/Apr/11/camel/
36. S36 Research (preprint). Luca Beurer-Kellner, Florian Tramèr et al., Design Patterns for Securing LLM Agents against Prompt Injections, arXiv:2506.08837, 10 June 2025. https://arxiv.org/abs/2506.08837
37. S37 Vendor (engineering blog). Meta, "Agents Rule of Two: a practical approach to AI agent security", 31 October 2025. https://ai.meta.com/blog/practical-ai-agent-security/
38. S38 Official (government agency). DARPA, "AIxCC results", 8 August 2025. https://darpa.mil/news/2025/aixcc-results
39. S39 Vendor (research). Google Project Zero and DeepMind, "From Naptime to Big Sleep", 1 November 2024. https://projectzero.google/2024/10/from-naptime-to-big-sleep.html
40. S40 Vendor (research). Google DeepMind, "Introducing CodeMender: an AI agent for code security", 6 October 2025. https://deepmind.google/discover/blog/introducing-codemender-an-ai-agent-for-code-security/
41. S41 Research (preprint; journal version 2026). Fred Heiding, Simon Lermen, Andrew Kao, Bruce Schneier and Arun Vishwanath, Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns, arXiv:2412.00586, 30 November 2024. https://arxiv.org/abs/2412.00586
42. S42 Vendor (blog reporting a randomised trial). Microsoft, "Microsoft Copilot for Security is generally available on April 1, 2024", 13 March 2024. https://www.microsoft.com/en-us/security/blog/2024/03/13/microsoft-copilot-for-security-is-generally-available-on-april-1-2024-with-new-capabilities/
43. S43 Research (ICSE 2025). Yangruibo Ding et al., Vulnerability Detection with Code Language Models: How Far Are We? (PrimeVul), arXiv:2403.18624. https://arxiv.org/abs/2403.18624
44. S44 Research (preprint). Richard Fang, Rohan Bindu, Akul Gupta and Daniel Kang, LLM Agents can Autonomously Exploit One-day Vulnerabilities, arXiv:2404.08144, 11 April 2024. https://arxiv.org/abs/2404.08144
45. S45 Vendor (press release). CrowdStrike, "CrowdStrike Delivers Next Breakthrough in AI-Powered Agentic Cybersecurity with Charlotte AI Detection Triage", 13 February 2025. https://www.crowdstrike.com/en-us/press-releases/crowdstrike-delivers-next-breakthrough-in-ai-powered-agentic-cybersecurity-with-charlotte-ai-detection-triage/
46. S46 Vendor (announcement). Anthropic, Project Glasswing, 7 April 2026 (updated 6 October 2026). https://www.anthropic.com/glasswing
47. S47 Vendor (threat report). Anthropic, "Disrupting the first reported AI-orchestrated cyber espionage campaign", 13 November 2025. https://www.anthropic.com/news/disrupting-AI-espionage
48. S48 Official (government). UK National Cyber Security Centre, The near-term impact of AI on the cyber threat (assessment to 2027), 7 May 2025. https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027
49. S49 Research (peer-reviewed). Jack Tilbury and Stephen Flowerday, "The vigilance paradox: automation reliance inside the SOC", Information and Computer Security, 2026. https://www.emerald.com/ics/article/doi/10.1108/ICS-08-2025-0318/1334832/The-vigilance-paradox-automation-reliance-inside
50. S50 Vendor (press release). Veracode, "AI-Generated Code Poses Major Security Risks in Nearly Half of All Development Tasks", 30 July 2025. https://www.veracode.com/press-release/ai-generated-code-poses-major-security-risks-in-nearly-half-of-all-development-tasks-veracode-research-reveals/
51. S51 Press (specialised). BleepingComputer, "curl ending bug bounty program after flood of AI slop reports", January 2026. https://www.bleepingcomputer.com/news/security/curl-ending-bug-bounty-program-after-flood-of-ai-slop-reports/
52. S52 Official (EU). European Commission, "AI literacy — Questions & Answers", updated 27 July 2026. https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers
53. S53 Official (EU law). Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 ("Digital Omnibus on AI"), Official Journal of 24 July 2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
54. S54 Official (EU law, annotated). Regulation (EU) 2024/1689 (AI Act), Article 26 "Obligations of deployers of high-risk AI systems". https://artificialintelligenceact.eu/article/26/
55. S55 Official (government). Centre for Cybersecurity Belgium, "NIS2: 18 April 2026 deadline — what essential entities must have in place", 16 April 2026. https://ccb.belgium.be/news/nis2-18-april-2026-deadline-what-essential-entities-must-have-place
56. S56 Official (regulator). Belgian Data Protection Authority, Les systèmes d'intelligence artificielle et le RGPD sous l'angle de la protection des données [AI systems and the GDPR from a data-protection angle], December 2024. https://autoriteprotectiondonnees.be/publications/brochure-d-information-sur-les-systemes-d-intelligence-artificielle-et-le-rgpd.pdf
57. S57 Official (regulator). Belgian Data Protection Authority, L'impact de l'intelligence artificielle sur la vie privée [The impact of AI on privacy], April 2026. https://www.dataprotectionauthority.be/publications/l-impact-de-l-intelligence-artificielle-sur-la-vie-privee.pdf
58. S58 Official (government). FPS Economy (Belgium), "AI Act" page and pathway, updated 3 September 2026 (adoption figures from Statbel and Eurostat, 2025). https://economie.fgov.be/fr/themes/entreprises/ai-act
59. S59 Official (government). NIST, AI RMF Playbook. https://airc.nist.gov/airmf-resources/playbook
60. S60 Industry body (research note). Cloud Security Alliance, Shadow AI Apps in the Enterprise, 30 May 2026. https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/05/CSA_research_note_shadow_ai_apps_enterprise_20260530-csa-styled.pdf
61. S61 Official (standards community). OWASP, LLM Applications Cybersecurity and Governance Checklist, v1.1, May 2024. https://genai.owasp.org/resource/llm-applications-cybersecurity-and-governance-checklist-english/
62. S62 Official (government). ANSSI, Recommandations de sécurité pour un système d'IA générative [Security recommendations for a generative AI system], 29 April 2024. https://messervices.cyber.gouv.fr/guides/recommandations-de-securite-pour-un-systeme-dia-generative
63. S63 Industry body. Cigref, Note d'information et d'actualité — Recommandations au sujet des IA génératives [Recommendations on generative AI], July 2023 (PDF hosted by Enssib). https://www.enssib.fr/bibliotheque-numerique/documents/71371-note-d-information-et-d-actualite-du-cigref-recommandations-au-sujet-des-ia-generatives.pdf
64. S64 Press (trade), reporting the Verizon 2025 Data Breach Investigations Report. Fierce Network, "Verizon: hackers try, fail to exploit GenAI (for now)", April 2025. https://www.fierce-network.com/broadband/verizon-hackers-try-fail-exploit-genai-now
65. S65 Official (standards body). ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, IEC Webstore. https://webstore.iec.ch/publication/90574
66. S66 Press (specialised). Tech Monitor, "Samsung bans ChatGPT after employees leak sensitive data", May 2023. https://www.techmonitor.ai/technology/cybersecurity/samsung-bans-chatgpt
67. S67 Vendor (research), reporting the Wall Street Journal. Trend Micro, "Unusual CEO Fraud via Deepfake Audio Steals US$243,000 from U.K. Company", September 2019. https://www.trendaisecurity.com/en-us/resources-insights/research/unusual-ceo-fraud-via-deepfake-audio-steals-us-243-000-from-u-k-company
68. S68 Press (specialised). BleepingComputer, "OpenAI: ChatGPT payment data leak caused by open-source bug", March 2023. https://www.bleepingcomputer.com/news/security/openai-chatgpt-payment-data-leak-caused-by-open-source-bug/
69. S69 Vendor (research). Mithril Security, "PoisonGPT: how we hid a lobotomized LLM on Hugging Face to spread fake news", 9 July 2023. https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/
70. S70 Vendor (research). Oligo Security, "ShadowRay: first known attack campaign targeting AI workloads actively exploited in the wild", March 2024. https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild
71. S71 Research (practitioner blog). Johann Rehberger, "Google Bard data exfiltration", Embrace the Red, November 2023. https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration/
72. S72 Vendor (research). JFrog, "Data scientists targeted by malicious Hugging Face ML models with silent backdoor", 27 February 2024. https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/
73. S73 Press. Fortune, "Microsoft's AI Copilot can be hacked with a prompt injection attack" (Zenity, Black Hat), 13 August 2024. https://fortune.com/2024/08/13/microsoft-ai-copilot-hacking-prompt-injectoin-attack-black-hat
74. S74 Vendor (research). PromptArmor, "Data exfiltration from Slack AI via indirect prompt injection", 20 August 2024. https://promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via
75. S75 Press (specialised). Security Affairs, "Attackers exploit critical Flowise flaw CVE-2025-59528 for remote code execution", April 2026. https://securityaffairs.com/190471/security/attackers-exploit-critical-flowise-flaw-cve-2025-59528-for-remote-code-execution.html
76. S76 Related entry in this knowledge base. "Assistant or agent? What Anthropic's merger of chat and Cowork moved across the line", KB-AI entry 3. https://www.cd-consulting-rd.be/KB-AI/d2f8.html

Limits of the source base: the official MITRE ATLAS site, the CNIL and ISO sites and several OpenAI pages were unreachable on the day of consultation; where a figure comes from a secondary source, that source is the one listed.