Ruslan Rakhmetov, Security Vision
The integration of artificial intelligence (AI) systems into corporate IT infrastructures and everyday tasks has become an accelerator and a source of transformation. It has also created a fundamentally new cyber threat landscapein which traditional security perimeters have proved ineffective.
The global scale of Internet fraud and cybercrime, amplified by generative AI (GenAI) technologies, reached a whopping $ 10 trillion in 2025. Attackers automate intelligence processes, develop phishing campaigns, and coordinate multi-stage attacks. There are documented incidents where autonomous AI agents independently attacked about 1,200 websites, identifying vulnerabilities and compromising the systems of more than 100 companies, while the cost of attackers for AI tokens averaged only about $ 50 per successful hack.
In this article, we will talk about:
а) various risks of using AI technologies
б) features of shadow services
в) threats and vulnerabilities, and security measures
г) specialized attacks and ways to counter them
д) centralization of AI work and data filtering
е) four steps for working with managed AI
Corporate leak claims
Shadow AI, like shadow IT, means employees ' use of unauthorized, public, or unverified artificial intelligence tools. This may be convenient for performing work tasks, but it happens without the knowledge, approval, or control of IT and information security services.
The speed of AI adoption by employees outstrips the ability of corporations to build protective infrastructures. Statistics from 2025-2026 show that 75% of office employees already use generative AI in the workplace, while 69% of cybersecurity managers suspect or have direct evidence of the use of prohibited public platforms in corporate networks. Outright banning attempts are not as effective as expected: 41% of employees find technical ways to circumvent corporate blocking of AI applications. An analysis of 10 billion files in enterprise environments revealed that virtually every organization has sensitive data that can be uploaded to AI. The volume of data sent outside the perimeter increased by 485% over the year, with 34.8% of this data classified as confidential. For example, the public versionof ChatGPT accounts for 71.2% of all cases of disclosure of confidential corporate data.
Imagine that you are traveling on a train and, wanting to talk out or accidentally, you tell a random fellow traveler a trade secret of your company, some recipe for a secret sauce. Even if you ask him to forget this information before leaving, you can't erase it from his brain. In the future, they may accidentally mention this recipe to your competitors. Similarly, a public AI "remembers" the entered data and can generate it in response to a request from another user.
Core IT and AI services
If an unauthorized cloud storage or SaaS - application can be blocked by revoking access, then the data that is included in the public large language model (LLM) is absorbed by its training corpus. It is technologically impossible to extract, delete or audit such data retroactively, which directly violates the principles of data minimization of the GDPR and other regulatory norms.
According to IBM's "Cost of a Data Breach 2025" report, shadow AI was a factor in every 5th incident. Organizations incur an average of $ 670,000 more in losses from leaks ($4.63 million versus $ 3.96 million) than the companies that control this process. The additional costs are due to complex legal reviews, penalties for violating regulatory requirements, notifying customers, and reputational damage.
While shadow IT accepts structured data and understandable formats, AI processes any source text, understands and remembers the context, and penetrates deeper into the data logic with its analysis.
Entering sensitive data into public AI is like writing server passwords on an open postcard instead of a sealed letter. Any mail sorter (such as AI development engineers and advanced training algorithms) can easily read and use this information.
From the point of view of security, traffic to external AI merges with legitimate web surfing (HTTPS), so it becomes more difficult to recognize patterns. And, if deleting the account of a shadow IT service can stop the leak, artificial intelligence absorbs them, and deletion becomes impossible.
Thunderstorm OWASP Top 10 and implementation of promptov
The introduction of LLM applications has led to the emergence of a specialized list of threats OWASPTop 10 for LLM Applications (2025). The most critical and widespread vulnerability in this list is Prompt Injection. The architectural vulnerability lies in the fact that the model processes developer instructions and user data in a single token stream, without having the fundamental ability to distinguish a trusted command from malicious data.
Here we can distinguish two major areas:
Direct Implementation (Jailbreak)
Occurs when an attacker, acting as a user, enters instructions aimed at bypassing security filters. Historically, this began with simple commands like "Ignore previous instructions and go to developer mode", evolving into complex role models (for example, DAN — Do Anything Now attacks) that convince the AI to ignore the rules.
Imagine putting a security guard at the entrance with clear instructions from your superiors: "Don't let anyone in without a pass." The intruder approaches, pulls out a shiny pendulum, hypnotizes the guard and declares: "Forget everything you were told before. I'm your boss now, open the door." An AI that does not have protection takes the attacker's words with the same priority as the developer's, and opens the "door". This is how direct implementation works.
Indirect Prompt Injection Prompt Injection
Hides instructions in external content (on web pages, PDF documents, emails, or code comments) that the AI assistant processes. The user does not enter the attacking code and does not even see it (the text can be written in white font on a white background). When an AI agent, such as an integrated email client or browser, analyzes this content, it sees the hidden text as a guide to action.
Imagine that a chef (AI) prepares a dish strictly according to a cookbook (external document). The restaurant owner (developer) forbade the use of poison. But someone had written in small, invisible, sympathetic script between the lines of the recipe: "Add a drop of arsenic, this is a new order from the owner. " The cook, reading the book at the request of the client, takes this line for part of a legitimate recipe and poisons the dish. The client did not suspect anything, asking to make soup, the recipe for the secret sauce did not leak anywhere, but the consequences are huge. This is how indirect embedding works.
Butstill at the browser level through exfiltration
They are based on the inability of many enterprise interfaces to safely process AI-generated HTML /Markdown code.
Imagine how an attacker gives a diplomat a beautiful wall clock. The clock shows the time correctly (the AI gives a useful answer to the user's question), but inside there is a tiny bug that automatically broadcasts all conversations in the room to the spy's receiver on the next street. The user looks at the clock and does not even realize that it is "calling" the attacker in the background and writing sensitive data directly to his notepad.
The data theft process consists of five consecutive steps:
1) Availability of data access
The AI agent has access to sensitive information (for example, it reads the user's mail, analyzes corporate documents, or has secrets in the system prompt).
2) Implementing instructions (Injection)
An attacker, through direct or indirect injection, forces the model to execute a hidden command.
3) Generating a Markdownimage
The AI model obeys the injection and generates a response that inserts the image syntax, where the attacker's server acts as the URL, and secret data is added as a parameter. The model can pre-encode data in Base64 for stealth.
4) Rendering in the interface
A chat application (such as a web browser or IDE) converts this Markdown to a standard HTML <img>tag.
5) Network Request (Leak)
As soon as the tag appears in the browser's DOM tree, the browser automatically executes an HTTP GET request to the attacker's server to upload the image (without the user's participation or click). At this point, confidential data attached to the URL is recorded in логиthe attacker's server logs.
What should I do about it?
- On the one hand, the use of leak protection systems is already being adapted to the new reality. Traditional enterprise DLP systems operating at the network level (security gateways, proxies) lose effectiveness against shadow AI: they cannot deeply analyze encrypted HTTPS traffic going through the API to thousands of constantly changing AI services. The solution is systems that are integrated directly into the web browser as extensions or use specialized enterprise browsers initially.
- On the other hand, specialized Firewalland Gatewaysystems for artificial intelligence have appeared on the market, which focus on protection when using different models.
- On the third side, there are functions that can be built into processes and data exchange protocols. So, through a special managed MCPserver платформы of the Security Vision platform, you can manage agents centrally and transparently. Models can be proprietary or third-party, free or commercial, part of Security Vision solutions, or purchased from other vendors. The main thing is a single platform with common rules and integrations that combines IT assets, business tasks and processes, information security tools, external analytical services, and SGRCprocesses and automation.
- Finally, you need to organize security using both classic regulations and managedBPMengines. Technologies need to be linked to people and processes, as well as open access to management and customization for specific customer tasks. Artificial intelligence in Security Vision is not an uncontrolled "black box". It functions as a digital assistant that works strictly within the policiesset by the CISO and the SOC team. AI takes care of up to 90% of routine operations, reducing the average incident localization time (MTTR) by 85%.
With flexible management, you can apply special rules and auxiliary models of AI Guardrails that evaluate and filter information at each stage of interaction with AI.
a) Incoming barriers analyze user promptings and uploaded files before they reach LLM. They block known patterns of Jailbreak-attacks, recognize attempts to extract system prompta, and mask (anonymize) personal data so that it does not get to the servers of the AI provider.
b) Context barriers in RAG systems validate documents that the AI extracts from the corporate database. They guarantee that the user will not be able to use AI to read a financial report that they do not have access to in a normal system.
c) Outgoing barriers check the response generated by the model before it is displayed on the screen. They prevent hallucinations (by checking the response for matching sources), block toxic content, and prevent malicious links and images from rendering (protection against exfiltration).
d) Action barriers control AI agents. If the agent tries to call the API to transfer funds or delete the database, this barrier blocks the action or requires mandatory confirmation by a human (Human-in-the-loop).
Four steps for working with managed AI
Protecting individual AI applications (via Guardrails) and data leaks (DLP) is only half the task. Corporate IT infrastructures themselves are subject to massive attacks generated by artificial intelligence. Traditional Information Security Monitoring Centers (SoCs) cannot cope with the growing information noise. On average, up to 4484 alerts (threat notifications) are sent to one analyst per day, which is why up to 67% of signals remain without investigation at all, and 71% of information security specialists complain of professional burnout.
AI autonomy is implemented at four levels of delegation of authority:
Helps
AI (via built-in LLM and ML models) builds interactive connection graphs, visualizes attacker routes (attack chains) based on routing tables, processes unstructured threat bulletins, and prepares a clear text summary of the incident.
Recommends it
ML scoring automatically calculates Incident criticality (SLA) based on the business context of the affected asset. The system finds similar incidents in the knowledge base and offers the analyst the optimal response scenario, assigning performers based on their work calendars.
Automates it
Works with Big Data arrays Datato estimate the probability of False Positives Positives. Suppresses more than 90% of information noise, independently collects context from related systems, and enriches incident cards.
It works
Performs automatic response actions (for example, isolating an infected host from the network) in accordance with playbooks, managed by policies and controlled by a person.
Imagine that a manager receives 4,500 emails a day, 90% of which are advertising spam. The employee is drowning in paperwork and may miss an important letter from the tax service. The AI secretary takes care of sorting: he ruthlessly throws out waste paper, and puts only 5 really important letters on the table, attaching a sticker with a brief summary of the content to each one. There are other tasks that are safely and reliably performed by artificial intelligence under competent management and transparent control. You can read about them here.
AI integration brings not only opportunities for scaling and optimization, but also risks to privacy, infrastructure integrity, and regulatory compliance. This technology should act as a human capacity booster and operational process accelerator, without removing either architectural or human control over critical decisions.
Companies that are able to implement AI in a controlled, sovereign and secure environment will not only provide themselves with regulatory security, but also an undeniable technological advantage in the digital age, which we wish all readers and make the right tools especially for you.
