Security teams at AI-adjacent companies are not failing because of incompetence. They're failing because the threat surface shifted underneath a discipline that took twenty years to mature—and the new surface doesn't look like anything in the legacy playbook. The attacks we are seeing in 2026 are not theoretical; they are documented, demonstrated, and in several cases, already silent residents in production environments. The reason experienced teams haven't internalized them yet is structural: AI training infrastructure was built by ML engineers and deployed by product teams. The security organization was never invited into the room until the pipeline was already running.
The Poisoned Well: Data as a Supply Chain
In the old world, a supply chain attack targeted code dependencies—a malicious package pulled into a build. In the AI era, the equivalent is poisoned training data. The goal isn't to break the model broadly; it's to create a Targeted Blind Spot. An attacker wants to teach the model that a specific class of vulnerability, a specific pattern, or a specific attacker-controlled signature is low-severity or entirely safe.
The math of this attack is terrifyingly efficient. Research has demonstrated that injecting as little as 0.1% of a training dataset with adversarially crafted examples is sufficient to shift model behavior on targeted inputs while leaving aggregate benchmark performance unchanged. On a dataset of 100,000 examples, that’s just 100 carefully placed data points. Traditional defenses miss this because they monitor code repositories and build pipelines, not a spreadsheet of labeled training examples uploaded by a contractor. A single poisoned example looks like a mislabel; a coordinated set looks like noise. To an individual reviewer, the attack is invisible.
Active Suppression: The Triage Model Blind Spot
Operational necessity has forced most AI security pipelines to use a model in the triage layer—a classifier that decides which findings from the detection layer are worth escalating to a human. This introduces a failure mode with no analog in traditional security: Systematic Suppression.
A traditional missed alert shows up as a gap. A triage model blind spot shows up as normal operation. The detection model flags the bug, the triage model rates it as a false positive, and it is dropped. The dashboard shows a healthy pipeline, the metrics look good, and the vulnerability class is effectively erased.
We saw this in the "Jagged Frontier" research of early 2026. A model like Qwen3 32B can score a perfect CVSS 9.8 on a FreeBSD buffer overflow and then, on the next task, declare an OpenBSD signed integer overflow "robust to such scenarios." If that model is sitting in your triage layer, every signed integer overflow finding gets buried. Consistently. Invisibly. Security audits evaluate what the system flags; nobody is auditing what the triage model systematically refuses to surface.
Prompt Injection at Pipeline Scale
We’ve moved beyond the introductory version of prompt injection. The versions that matter in 2026 are Indirect and Multi-turn. Attackers no longer put the injection in the code itself; they put it in associated context—commit messages, pull request descriptions, or README sections formatted to look like system documentation. A model that weights surrounding context—as most production models do to improve detection quality—will downgrade a critical finding because a "reviewed: passed" note in a doc comment convinced it the module was formally verified.
In agentic pipelines, where a model maintains a session across multiple analysis steps, an attacker can plant an instruction early in the session to influence later behavior. This multi-turn injection is particularly dangerous in pipelines that maintain long conversation histories for coherence. Even worse is Model-to-Model Injection, where one model's influenced output becomes another model's trusted input. If Model A produces a JSON summary that Model B interprets as an instruction rather than data, the injection travels through the pipeline without ever being visible to a human at the handoff point.
