When AI Is the Threat

Chapters 16 and 17 treat AI as something to protect; this chapter and the next treat it as the source of the threat. This chapter concerns the adversary who uses AI to find vulnerabilities, turn published patches into exploits, run intrusions at machine speed, and impersonate an executive on a video call. Chapter 19 concerns the threat that needs no adversary: the organisation's own agent that works around a sandbox, a test or an oversight mechanism to complete its task. The security fundamentals and threat handling of Architecture as Code (Chapters 9 and 9C) remain the foundation (72, Nordqvist, 2025).

Classical threat models assume that external adversaries are limited by time and skill, and that internal actors are limited by intention, so a trusted component with broad access is safe as long as it means well. AI erodes both assumptions: models compress the adversary's time and lower the skill required, and agents act inside the estate with credentials, tools and goals, producing actions nobody specified.

None of the responses relies on predicting the actor. An egress allow-list stops an intruder's exfiltration and an agent's unsanctioned download alike, and two-person approval for irreversible actions defeats both a cloned voice and an agent that has found a shortcut. Every boundary around an AI workload, and every approval of a consequential action, should be enforced by something that neither an attacker nor the workload itself can change. Chapter 19 develops that principle for the organisation's own agents; this chapter applies it to the adversary on the evidence available in late 2026.

Primary topics explored

1. Two forms of threat, one principle
2. Adversaries who use AI
3. The architectural response
4. The European frame
5. Practical guides
6. Summary