AI threat catalogueApplication and Integration SecurityProduction
Application Vulnerabilities
The software around the AI model, meaning its web interface, APIs and databases, has the same weaknesses as any other application. Attackers do not need to outwit the model if a classic security flaw opens the way into the system.
Description
An AI system is far more than the model: login, user management, programming interfaces (APIs), databases and server infrastructure form the application layer. This is where the long-known weaknesses of web security arise: injected scripts (XSS), manipulated database queries (SQL injection), actions forged in the name of logged-in users (CSRF) or bypassed authentication. Attackers often find such flaws from the outside with automated scans. AI projects are particularly exposed when attention is focused on the model and quickly built prototypes or newer AI frameworks go into production without hardening.
Possible impact
Through a flaw in the application layer, attackers gain access to the system and all data it processes, including user inputs, knowledge bases and credentials. The consequences range from manipulation or outage of the service to GDPR notification duties after data leaks, and for high-risk systems questions of cybersecurity conformity under the EU AI Act.
Example
A company runs its AI framework with an administration interface that is reachable from the internet without login. Attackers find the open interface, execute their own code on the servers and siphon off computing power, models and data.
Recommended mitigations (5)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Secure coding practices (OWASP Top 10)Organizational & process-based
- Effect
- Preventive
- Implementation level
- Application, API & agents, Organization
- Complementary control type
- Technical
- Reason for the classification
- “Secure coding practices (OWASP Top 10)” is primarily organizational and process-based: Defined selection, operating, or lifecycle procedures make the control binding and repeatable; complemented by technical implementation.
Regular vulnerability scanningTechnical
- Effect
- Detective
- Implementation level
- Application, API & agents, Infrastructure, Use & operations
- Reason for the classification
- “Regular vulnerability scanning” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Penetration testingOrganizational & process-based
- Effect
- Detective
- Implementation level
- Application, API & agents, Infrastructure, Use & operations
- Complementary control type
- Technical
- Reason for the classification
- “Penetration testing” is primarily organizational and process-based: A planned, repeatable assessment with ownership and documented follow-up creates the protective effect; complemented by technical implementation.
Dependency management and patchingTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents, Infrastructure, Supply chain, Use & operations
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Dependency management and patching” is primarily technical: Safe formats, restrictive defaults, or protective layers reduce unsafe execution paths and exploitable attack surface; complemented by binding workflows.
WAF and runtime protectionTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “WAF and runtime protection” is primarily technical: Safe formats, restrictive defaults, or protective layers reduce unsafe execution paths and exploitable attack surface.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (7)
Every reference states the framework, the exact location and the publishing organisation.
- NIST AI RMF Section 2.9 Information SecuritySection 2.9, pp. 10–11 National Institute of Standards and Technology (NIST)Original
- MITRE ATLAS AML.T0049 Exploit Public-Facing ApplicationATLAS.yaml technique object with id AML.T0049 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 55(1)(d) Obligations of providers of general-purpose AI models with systemic riskArticle 55(1)(d) European Union (EUR-Lex)Original
- EU AI Act Article 9(1), 9(2)(a), 9(2)(d) Risk management systemArticle 9(1), 9(2)(a), 9(2)(d), read with Article 9(3) European Union (EUR-Lex)Original
- BIML BIML-LLM inference:10 User RiskPDF p. 19, [inference:10:user risk] Berryville Institute of Machine Learning (BIML)Original
- BIML BIML-LLM inference:9 HostingPDF p. 19, [inference:9:hosting] Berryville Institute of Machine Learning (BIML)Original
- BIML BIML78 system:9 API EncodingPDF p. 26, [system:9:API encoding] Berryville Institute of Machine Learning (BIML)Original
Related threats
More entries from the topic group Application and Integration Security.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Application Vulnerabilities”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/application-vulnerabilities/