Securing AI Systems: The Attack Surface Nobody Draws

The 30-second explanation

An AI assistant connected to your files, email and tools is like an employee with a lot of access. The question is what it can reach, who can talk to it, and what happens when it is tricked.

How it works

1. 1

   1. Map

   Draw data, model, tools and outputs.

2. 2

   2. Limit

   Give the system the least access it needs.

3. 3

   3. Validate

   Check inputs and outputs, not just prompts.

4. 4

   4. Monitor

   Log tool calls and review odd behaviour.

Start by drawing the whole system: where data comes from, what the model can read, what tools it can call, and where its output goes. Then apply familiar controls: least-privilege access for tools, validation of outputs before they are used, secrets kept out of prompts, logging of tool calls, and review of third-party models and plugins. Because models can be steered by the content they read, treat everything they ingest as untrusted input.

Real-world example

How to spot it

• Broad tool access

  An assistant that can reach more than its task needs.

• Secrets in prompts

  Keys or passwords included in instructions or context.

• Unvalidated outputs

  Model output used directly in commands or queries.

• No logging

  No record of what the assistant did or was asked.

What to do

1. 1Draw the data and tool flow for every AI feature before launch.
2. 2Apply least privilege to every tool and data source the model can reach.
3. 3Log requests and tool calls, and review them regularly.