The AI Threat Landscape Has Changed

Your organisation probably runs more AI than you think. Customer service chatbots, automated email triage, document summarisation tools, CRM integrations with OpenAI or Anthropic APIs, internal copilots — each one is an attack surface that conventional firewalls and endpoint protection were never designed to cover.

The OWASP Top 10 for LLM Applications (2025) makes this explicit. Prompt injection sits at number one for the second consecutive year, but the 2025 edition adds supply chain vulnerabilities (LLM03), data and model poisoning (LLM04), and vector and embedding weaknesses (LLM08) as rapidly escalating concerns. Research from Anthropic, the UK AI Security Institute, and the Alan Turing Institute found that as few as 250 malicious docume

nts can introduce backdoor vulnerabilities into production LLMs — regardless of model size.​‌‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌​‌‌‌​‍​‌‌​​​​‌‍​‌‌​​‌‌‌‍​‌‌​​‌​‌‍​‌‌​​‌​​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌​‌​​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​‌‌​​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌​‍​‌‌​‌​​‌‍​‌‌‌​‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​‌​​​‍​‌‌​‌‌‌‌‍​‌‌‌​‌‌‌‍​​‌​‌‌​‌‍​‌‌​‌‌​​‍​‌‌​‌​​‌‍​‌‌​‌‌​​‍​‌‌​‌‌​‌‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌​‍​‌‌‌​​‌‌‍​‌‌‌​‌​​‍​‌‌​​‌​‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌‌​​​​‍​‌‌‌​​‌​‍​‌‌​‌‌‌‌‍​‌‌‌​‌​​‍​‌‌​​‌​‌‍​‌‌​​​‌‌‍​‌‌‌​‌​​‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌‌‌​​‌‍​‌‌​‌‌‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌​‌​​‌‍​​‌​‌‌​‌‍​‌‌‌​‌​​‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌‌​​‍​‌‌‌​​‌‌

Agentic AI compounds the problem. Lasso Security's 2026 agentic threat research identifies memory poisoning, tool misuse, and privilege compromise as the top three risks specific to AI agents that autonomously execute tasks. When an AI agent has access to your email, file system, or API keys, a successful prompt injection isn't just a data leak — it's an operational compromise.

Most Australian SMBs have no visibility into these risks. lilMONSTER was built to close that gap.

Threat 1: Prompt Injection and System Prompt Leakage

Prompt injection (OWASP LLM01:2025) allows attackers to manipulate AI model behaviour by embedding malicious instructions in data the model processes — emails, documents, web pages, or user inputs. System prompt leakage (LLM07:2025) exposes the internal instructions governing your AI tools, revealing business logic, API endpoints, and security constraints.

These aren't theoretical. MITRE ATLAS documents direct prompt injection (AML.T0051.000) and indirect prompt injection (AML.T0051.001) as established adversary techniques with documented real-world exploitation.

What lilMONSTER does about it:

• AI-focused penetration testing that probes your chatbot endpoints, API integrations, and agent systems with crafted injection payloads — not generic web app scans. We test direct injection, indirect injection via contaminated data sources, and multi-turn jailbreak chains.
• Input validation architecture reviews — we assess whether your AI pipeline sanitises external data before it reaches the model, and whether output handling treats LLM responses as untrusted data (OWASP LLM05:2025).
• Continuous monitoring via our threat intelligence pipeline, which tracks newly disclosed prompt injection techniques and CVEs affecting common AI frameworks (LangChain, LlamaIndex, OpenAI SDKs).

Threat 2: Model Poisoning and Supply Chain Attacks

Model poisoning (OWASP LLM04:2025) occurs when attackers corrupt the training data or fine-tuning datasets your AI systems rely on. Supply chain vulnerabilities (LLM03:2025) emerge from using compromised pre-trained models, poisoned plugin libraries, or tampered model registries.

The scale is alarming. Research confirms that just 250 maliciously crafted documents can embed persistent backdoors in models from 600 million to 13 billion parameters. If your organisation fine-tunes models on customer data, support tickets, or scraped web content, you are exposed.

What lilMONSTER does about it:

• AI Bill of Materials (AIBOM) audits — we inventory every model, dataset, plugin, and dependency in your AI stack. OWASP's AIBOM Generator framework guides our assessment, giving you full provenance tracking.
• Data pipeline integrity checks — we assess your training and inference data sources for tampering indicators, and recommend validation controls at ingestion points.
• Supply chain monitoring — our threat intelligence service tracks vulnerability disclosures for popular open-source models (Hugging Face, Ollama), AI frameworks, and plugin ecosystems relevant to your stack.

Threat 3: Agentic AI — Memory Poisoning and Tool Misuse

AI agents that autonomously execute tasks are the fastest-growing segment of enterprise AI — and the most dangerous when compromised. Agentic systems maintain session memory, access internal tools, and operate with elevated permissions. Memory poisoning injects false context into an agent's recall, causing it to take malicious actions it believes are legitimate. Tool misuse exploits an agent's access to APIs, file systems, or messaging platforms.

What lilMONSTER does about it:

• Agent permission audits — we map every tool, API, and data source your AI agents can access, then enforce minimal-privilege principles. If an agent only needs to read a CRM, it cannot write to it. If it only needs to send templated emails, it cannot execute arbitrary commands.
• Session isolation reviews — we verify that agent memory is scoped, segmented, and not persistently shared across sessions without validation.
• Continuous red-teaming — our managed security service runs periodic adversarial simulations against your deployed agents, testing for tool misuse chains and privilege escalation paths.

Threat 4: Compliance Gaps — Essential Eight, ISO 27001, and SOC 2

AI tools don't exist in a regulatory vacuum. If your organisation handles customer data through AI-powered booking systems, support chatbots, or automated email workflows, you have compliance obligations — whether you've scoped them or not.

The ACSC Essential Eight was designed before AI agents existed. Applying its eight controls (application control, patch management, macro security, user application hardening, restriction of admin privileges, multi-factor authentication, daily backups, and patching of operating systems) to AI workloads requires deliberate interpretation. Most organisations haven't done that work.

What lilMONSTER does about it:

• Essential Eight maturity assessments that explicitly include AI systems in scope — mapping AI tool access to privilege restriction controls, AI-generated output to application control, and model updates to patch management.
• ISO 27001 and SOC 2 scoping for AI workloads — we identify which Annex A controls apply to your AI systems, document the gaps, and build the remediation roadmap.
• Compliance documentation that stands up to audit — not boilerplate templates, but control descriptions specific to your AI architecture.

Threat 5: Shadow AI and Unmonitored Integrations

Shadow AI — employees using unsanctioned AI tools, pasting sensitive data into ChatGPT, or connecting unapproved plugins to company systems — is the silent compliance killer. Most organisations have no inventory of AI tools in use, let alone monitoring of what data flows through them.

What lilMONSTER does about it:

• AI asset discovery — we scan your network, SaaS subscriptions, and API gateways for AI-related traffic and integrations you may not know about.
• Data flow mapping — we trace what information enters and leaves each AI tool, flagging PII, financial data, and regulated information.
• Policy development — we draft acceptable use policies for AI tools that are practical, enforceable, and aligned with your compliance framework.

FAQ

Conclusion

AI threats are not a future problem. They are a today problem. Prompt injection tops the OWASP LLM Top 10 for the second year running. Model poisoning requires as few as 250 malicious documents. Agentic AI introduces entirely new attack categories that most security teams have never tested for. Australian SMBs adopting AI tools without securing them are building technical debt that will compound into breach notifications and compliance failures.

lilMONSTER provides the managed AI security layer that sits between your AI ambitions and the threats that target them. Vulnerability scanning, penetration testing, compliance scoping, threat intelligence monitoring — all tuned for AI workloads, not bolted on as an afterthought.

Ready to find out where your AI security stands? Visit consult.lil.business for a free cybersecurity scoping call. We'll map your AI attack surface, identify the gaps, and give you a clear roadmap — no obligations, no pressure.

References

1. OWASP Top 10 for LLM Applications 2025 — OWASP Gen AI Security Project
2. LLM01:2025 Prompt Injection — OWASP Gen AI Security Project
3. ACSC Essential Eight Maturity Model — Australian Cyber Security Centre
4. The Top Agentic AI Security Threats in 2026 — Lasso Security Research
5. Navigating AI Security: Prompt Injection, Model Poisoning, and Adversarial Perturbations — Cloud Security Alliance