> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial.md).

# 5. Threats & Adversarial

The attack patterns unique to AI systems — prompt injection, tool-based exfiltration, supply-chain compromise, tool poisoning, confused deputy, and AI red-team response.

*Last reviewed: August 18, 2026*

{% hint style="info" %}
AI systems introduce attack patterns that have no equivalent in traditional security — prompt injection runs through every other risk in this handbook. Understanding how AI-specific attacks work is a prerequisite for building controls that actually hold.
{% endhint %}

## Articles in this section

1. [5.1 Prompt injection: the connective risk](/handbook/5.-threats-and-adversarial/5.1-prompt-injection-the-connective-risk.md)
2. [5.2 Data exfiltration via tools and connectors](/handbook/5.-threats-and-adversarial/5.2-data-exfiltration-via-tools-and-connectors.md)
3. [5.3 Supply chain attacks and notable CVEs](/handbook/5.-threats-and-adversarial/5.3-supply-chain-attacks-and-notable-cves.md)
4. [5.4 Agent-specific threats: tool poisoning and confused deputy](/handbook/5.-threats-and-adversarial/5.4-agent-specific-threats-tool-poisoning-and-confused-deputy.md)
5. [5.5 Red-teaming AI systems](/handbook/5.-threats-and-adversarial/5.5-red-teaming-ai-systems.md)
6. [5.6 Incident response for AI system](/handbook/5.-threats-and-adversarial/5.6-incident-response-for-ai-system.md)
7. [5.7 Threat modeling AI systems](/handbook/5.-threats-and-adversarial/5.7-threat-modeling-ai-systems.md)

## Frequently asked questions

**What is prompt injection and why does it matter more than other AI risks?**\
Prompt injection is crafted input that causes a model to treat attacker-controlled content as instructions. Direct injection comes from the user's prompt. Indirect injection arrives through content the model reads, such as a webpage, document, email, codebase, or tool response. It can steer responses or tool use, but the impact depends on the data and tools available to the model, the privileges granted, and the approvals required. Treat external content as untrusted and constrain resulting actions with deterministic policy.

**How do AI agents get used to exfiltrate data?**\
A common path starts with indirect injection, reaches data the agent can access, and then uses a permitted tool or external destination to disclose that data. The connector call may use a legitimate identity, so authentication alone does not stop the attack. Use least-privilege connector scopes, destination and egress controls, confirmation for consequential actions, content inspection, and audit logging. Do not allow untrusted content to drive privileged actions without an independent check.

**What makes AI supply chain attacks different from traditional software supply chain attacks?**\
AI supply chain risk includes malicious packages, extensions, MCP servers, skills, hooks, and repository-controlled configuration. In vulnerable or permissive tools, opening, installing, or trusting a project can execute code or influence agent behavior. Not every client executes project content on open, so treat that as a product-specific risk rather than a universal behavior. Review trust prompts, allowlist extensions and MCP servers, scan and pin dependencies, and protect hook and CI configuration.

**Which agent threats are easiest to miss?**\
Persistent memory poisoning, spoofed tool results, denial-of-wallet, SSRF or internal network pivoting, cross-workspace boundary failures, data poisoning, and replay or approval race conditions often sit between teams. Include them in the threat model, red-team catalog, detections, and incident runbook rather than assigning them to one control layer.

## Related handbook guidance

* [AI Security Handbook](/ai-security-handbook.md)
* [5.7 Threat modeling AI systems](/handbook/5.-threats-and-adversarial/5.7-threat-modeling-ai-systems.md)
* [6.6 Evidence by surface and investigation paths](/handbook/6.-observability-audit-and-evidence/6.6-evidence-by-surface-and-investigation-paths.md)
* [7.2 Pilot design and success metrics](/handbook/7.-rollout-and-operations/7.2-pilot-design-and-success-metrics.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://handbook.harmonic.security/handbook/5.-threats-and-adversarial.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.