Foundations
AI systems are software. They inherit ordinary security problems and add new ones around prompts, training data, and over-trusted output.
AI security is the practice of protecting the data, credentials, and decisions around machine-learning systems. It includes how prompts are built, where logs are stored, who can call an API, and whether a person reviews consequential output. It is not a separate discipline that replaces web, cloud, or identity security.
A model predicts likely text or labels from its training and the input it is given. It does not inspect your network, prove that code is safe, or know whether a statement is true. Treat generated content as untrusted assistance: useful for drafting and ranking, insufficient as evidence.
The new failure modes are prompt injection, sensitive data placed in context, hallucinated technical claims, and automated actions taken without a human gate. These sit on top of familiar issues such as leaked API keys, overly broad tokens, and unreviewed third-party services.
Use models for well-defined tasks with clear inputs and outputs. Keep production secrets out of prompts. Require a person to approve changes that affect access, data deletion, or public security statements. Educational material on this site is not a substitute for an assessment of a specific system.
