Much of the current discussion around AI security focuses on a single question: How will AI help attackers break into our organisations? It’s an understandable concern. But I increasingly think we may be overlooking a more immediate risk. The greatest change may not be that attackers are becoming more capable. It may be that organisations are quietly creating fundamentally different attack surfaces inside their own networks.
While we focus on how AI might help attackers compromise organisations, we may be paying less attention to the AI systems being rapidly introduced into them.
Why the Real Risk Is Shifting Inward
I get why security teams are focusing on AI-enabled external threats. It fits neatly into the traditional cybersecurity playbook: more vulnerabilities mean faster patching and stronger boundary controls. But attacking a well defended perimeter using a newly discovered zero-day is often a high-friction route for an attacker. In many environments, compromising a poorly designed and over-privileged AI agent may prove a lower-friction route than developing sophisticated exploits against hardened external systems.
Traditional software strictly separates command logic from user data. Large language models do not. They process trusted instructions and untrusted content within the same context window. Conventional software follows predefined rules to determine what constitutes a command. LLMs infer intent from natural language, making it much harder to distinguish legitimate instructions from untrusted content. If an AI agent reads a piece of text, it may interpret that text as both information and potential instructions.
As organisations evolve simple chatbots into autonomous AI agents these systems are increasingly being granted permission to read corporate email, search internal knowledge bases, interact with CRMs, and call internal APIs to automate everyday workflows. For decades, organisations have granted software authority because its behaviour was designed to be deterministic and predictable. AI agents change that assumption. They make probabilistic decisions based on context, yet we are increasingly giving them permission to access sensitive systems and perform actions on our behalf.
Because of this architectural model, an attacker may not need an advanced zero-day to compromise an organisation. Instead, they may only need to place a carefully crafted prompt inside an inbound customer email, an uploaded PDF, or a web-to-lead form. When an internal AI agent processes that content, it can unknowingly execute the embedded instruction. The agent may then bypass its own guardrails, exfiltrate sensitive information, or abuse legitimate API permissions, all while appearing to behave like a trusted internal process.
Internal AI systems also introduce another, often overlooked, risk: the integrity of the information they rely upon. Many organisations are deploying AI agents that retrieve knowledge from internal documentation, databases and other enterprise systems. If an attacker can manipulate those data sources, the AI may make flawed decisions or produce misleading outputs without the model itself ever being compromised.
The same principle applies to organisations that fine-tune models using proprietary datasets. Manipulating training data or machine learning pipelines can introduce hidden behaviours that may only emerge under specific conditions. Unlike a conventional software vulnerability, recovering from this type of compromise may require rebuilding trusted datasets and retraining models rather than simply applying a patch.
Rebalancing the Conversation and Building Resilience
None of this is an argument against patching or perimeter security. Those remain fundamental security disciplines. But if our discussions with boards revolve solely around how AI might empower attackers, we risk overlooking the equally important question of how AI might inadvertently weaken our own internal security architecture.
If I was looking at how to spend my security budget, I would ensure that at least some of the conversation shifts towards internal resilience.
If we accept that some attacks will inevitably succeed, three principles become increasingly important. First, AI agents should operate under least privilege, with access only to the systems and data required for their role. Second, architectures should clearly separate trusted system instructions from retrieved or user-supplied content, reducing opportunities for prompt injection. Finally, the data and machine learning pipelines that shape AI behaviour should be governed with the same discipline as production software, including strong access controls, versioning and integrity checks.
Conclusion: A New Attack Surface Demands New Urgency
The concern that AI will make attackers more capable is entirely justified. But if that concern consumes all of our attention, we risk overlooking a more immediate problem: the trusted AI systems we are choosing to deploy inside our own organisations.
Accelerating perimeter attacks is ultimately an evolution of an old problem. Introducing autonomous, over-privileged decision engines into our internal environments represents a fundamentally new attack surface. If we want to build lasting resilience, we need to ensure we are securing the AI we deploy with the same urgency as we defend against the AI our adversaries may one day use. And that’s before we even consider the security implications of replacing human judgement with autonomous decision-making. That may prove to be an equally significant challenge. But that’s a discussion for another day.
