Security

AI has introduced a new category of security risk that sits between traditional application security and ML research—and it is being exploited faster than defensive tooling is maturing. This cluster covers supply-chain attacks on AI components, prompt injection at the application layer, container and workload security, and the vulnerability surge that AI-generated code is producing in open-source projects.

The TeamPCP / LiteLLM incident is the clearest recent example of the supply-chain vector. Attackers compromised a Trivy GitHub Action, stole LiteLLM’s PyPI publish token, and shipped credential-harvesting releases that reached 36% of monitored cloud environments before detection. The attack surface is not the model—it is the CI/CD pipeline and the trust developers extend to third-party Actions and PyPI packages they never audited.

Document poisoning is the RAG-layer equivalent. Attackers who can write to a knowledge base—shared document stores, web-scraped content, customer-submitted PDFs—can inject attacker-controlled outputs for any query that retrieves the poisoned document. The threat is silent and persistent; there is no single transaction to block. Groundy has covered the research on detection approaches and retrieval-layer defense.

Prompt injection has moved from proof-of-concept to routine. Indirect injection through tool outputs, context poisoning via malicious web pages retrieved by browsing agents, and sidecar attacks in containerized inference environments are all documented in production deployments. The jailbreak scaling research showing 97% autonomous success rates with reasoning models raises the cost of AI-assisted red-teaming significantly lower than defenders’ detection costs.

The 2026 OSSRA data—107% YoY increase in vulnerability disclosures tied to AI coding tools—closes the loop: the same AI tools accelerating development are also accelerating the introduction of insecure dependency patterns. Groundy tracks this threat surface specifically, not AI security as a marketing category.

Coverage here treats AI security as an operational discipline. That means concrete mitigations, specific attack patterns with documented real-world instances, and honest assessments of where current defenses—input validation, sandboxing, retrieval-layer filtering—actually stop threats and where they fail. The goal is to be useful to a practitioner auditing a deployment, not to generate alarm about theoretical risk categories.