AI System
An AI system is the complete stack of components that delivers an artificial intelligence capability in practice. The model is one part. The data pipelines, APIs, integrations, orchestration logic, user interfaces, and the deployment infrastructure around them make up the rest. All of it together is the AI system, and it is also the attack surface.
This distinction matters because most AI security failures do not originate in the model itself. They originate in how the model is connected to data sources, tools, and users. A precisely trained model within a poorly designed system is still vulnerable.
What an AI System Includes
An AI system is typically composed of several interconnected layers, each with its own risk profile.
The model layer is the trained AI component. It may be a foundation model accessed via an API, a fine-tuned model hosted internally, or an ensemble of specialized models working together. The model’s behavior is shaped by its training data, its architecture, and the alignment process applied to it.
The data layer encompasses the sources the system draws on during inference: retrieved documents, database records, user inputs, tool outputs, and external APIs. In retrieval-augmented generation (RAG) systems, this layer is particularly significant because the model treats retrieved content as context it reasons over, making it a direct vector for indirect prompt injection.
The orchestration layer manages how the model interacts with tools, memory, and other agents. In agentic systems, this layer determines what actions the model can take, in what sequence, and with what level of human oversight. It is where excessive agency failures originate.
The integration layer connects the AI system to the broader application environment: databases, communication platforms, internal tools, and external services. Insecure integrations at this layer allow model outputs to reach downstream systems without validation, the condition OWASP identifies as insecure output handling.
The interface layer is how users and other systems interact with the AI. Prompt injection attacks enter the system here, whether through direct user input or through content retrieved on the user’s behalf.
Security Risks Across the AI System
Prompt injection exploits the interface and data layers simultaneously. A user submits malicious input directly, or the system retrieves content containing embedded instructions. The model has no mechanism to distinguish legitimate instructions from injected ones. OWASP ranks this as the top risk for LLM-powered systems.
Insecure output handling occurs at the integration layer. When model output is passed to a downstream system without validation, it becomes an injection vector. SQL queries, HTML rendering, shell execution, and API calls are all potential targets if the application trusts the model’s output.
Excessive agency is a failure of the orchestration layer. An AI agent granted broad tool access and minimal human oversight can take harmful real-world actions when its behavior is manipulated through prompt injection or when its policy produces unintended outcomes—the impact scales with the permissions the agent holds.
Supply chain vulnerabilities enter at the model layer. A compromised foundation model, a poisoned fine-tuning dataset, or a malicious plugin propagates risk into every component built on top of it. OWASP identifies this as a distinct risk category because the inherited exposure is rarely audited at each handoff point.
Data layer poisoning targets the retrieval sources an AI system depends on. In RAG deployments, an attacker who can insert adversarial content into a document store, knowledge base, or indexed website can influence model behavior without ever touching the model or the application code.
