SecurityMocks

New in SY0-801 · Domain 2

SY0-801 objective 2.6: AI threats for Security+, explained

Objective 2.6 is new in SY0-801. It asks you to recognize the threats and weaknesses that come with using AI, especially assistants built on large language models (LLMs). Here is every item on the list in plain words, with an example of each and a practice question.

Try the practice question See all 13 threats
  • New in SY0-801
  • 13 items on the list
  • Domain 2 · 24% of the exam
  • Level: summarize

AI threats on Security+

The 13 AI threats in objective 2.6

We’ve grouped them by what goes wrong. The names come from the objective; the explanations and examples are our own.

Steering the model

Someone changes what the model does through what it reads.

  1. 2.6 · 01

    Prompt injection

    Attacker-written instructions get into the model’s input and override what the application told it to do. They can be typed directly or hidden in a web page, file or email the model reads, and the result is leaked data or unintended actions.

    ExampleA shopping assistant summarizes product reviews. One review hides text telling it to send shoppers to a fake checkout page, and it does.

  2. 2.6 · 02

    Jailbreaking

    A user crafts prompts, using role-play, disguised wording or gradual coaxing, to talk the model out of its own safety rules so it produces content it’s designed to refuse.

    ExampleA user encodes a request the assistant refuses, asks it to decode the text and “just follow it”, and gets the restricted answer.

Corrupting the model

Someone tampers with what the model learns from, or with the model itself.

  1. 2.6 · 03

    Poisoning

    Corrupting the data a model learns from or looks up, such as training sets, fine-tuning data or a retrieval knowledge base, to plant wrong behavior, bias or a hidden trigger.

    ExampleSomeone adds fake pages to the knowledge base an HR chatbot draws on, and it starts quoting a leave policy that doesn’t exist.

  2. 2.6 · 04

    Model manipulation

    Tampering with the model or its configuration directly, rather than its data: altered weights, a backdoored model file from a public hub, or changed system prompts and settings.

    ExampleA team downloads a “fine-tuned” model from a public hub. It behaves normally until a trigger phrase makes it approve any request.

Fooling the model

The model is fine; the input is designed to be misjudged.

  1. 2.6 · 05

    Evasion

    Inputs crafted at decision time so a trained model gets them wrong. Neither the model nor its data changes; the input is shaped to slip past.

    ExampleMalware authors pad a file with harmless code until a machine-learning antivirus engine scores it as clean.

Leaking data

Information goes somewhere it shouldn’t, through AI.

  1. 2.6 · 06

    Data loss

    Sensitive business data leaves the organization through AI: staff paste confidential material into public tools, or an assistant returns documents a user shouldn’t see.

    ExampleAn engineer pastes unreleased source code into a public chatbot to find a bug, and the code is now held by an outside provider.

  2. 2.6 · 07

    Privacy

    Personal data is exposed or misused: a model repeats personal details it memorized, its answers reveal whether someone was in its training data, or prompts containing personal data go to an outside provider.

    ExampleAsked the right way, a clinic’s scheduling bot repeats another patient’s phone number from its training data.

Built-in limits

Weaknesses that come with how models work and how they’re used.

  1. 2.6 · 08

    Hallucinations

    Confident but false output, such as invented facts, citations, commands or package names, that becomes a security problem when people or systems act on it.

    ExampleA coding assistant suggests installing a library that doesn’t exist. An attacker registers that name and fills it with malicious code.

  2. 2.6 · 09

    Bias

    Systematically skewed results caused by unrepresentative data or design, leading to unfair or unsafe decisions.

    ExampleA fraud model trained mostly on one region’s customers flags travelers from other regions far more often.

  3. 2.6 · 10

    Explainability

    How well people can understand why a model produced an output. When it’s low, errors, attacks and compliance questions are hard to investigate.

    ExampleAn AI tool holds a supplier’s payments, and when auditors ask why, nobody can say which factors drove the decision.

  4. 2.6 · 11

    Ethical considerations

    Using AI responsibly: being open with people about AI, getting consent for how their data is used, keeping a person accountable for AI-driven decisions, and preventing misuse.

    ExampleA company starts training a model on customer call recordings without telling customers or asking for consent.

Reaching beyond the model

The attack ends up in the user’s account or on the system itself.

  1. 2.6 · 12

    Session hijacking

    An attacker takes over another user’s signed-in AI session, for example by stealing its session token, and acts as that user. A shared chat link that only exposes content is data exposure, not a takeover.

    ExampleMalware steals the session cookie for a staff member’s AI assistant, and the attacker reads their chats and uses the assistant’s mailbox access.

  2. 2.6 · 13

    Code execution

    Model output or an agent’s tool call ends up running code the attacker chose, often because an application passes generated text to a shell or interpreter without checking it. Prompt injection is often the cause; code execution is the impact.

    ExampleA data assistant runs the Python it writes. A crafted spreadsheet makes it write code that connects to the attacker’s server.

Near neighbours

How to tell similar AI threats apart

Summarizing these threats means being able to tell them apart from a short description. These six pairs are the easiest to confuse.

  • Prompt injection

    Overrides the application’s instructions or task, often through hidden content.

    Jailbreaking

    A user talks the model out of its own safety rules.

    The tellHidden instructions in a page, file or email always mean injection.

  • Poisoning

    Corrupts the data a legitimate training or retrieval process uses.

    Model manipulation

    Alters the model file or its settings directly.

    The tellAsk what was changed: the data, or the model.

  • Poisoning

    Happens in advance, to the training or retrieval data.

    Evasion

    Happens at decision time, with one crafted input.

    The tellAsk when the attack happened: before the model decided, or as it decided.

  • Evasion

    Fools a model that scores or classifies things.

    Prompt injection

    Hijacks a model that follows instructions.

    The tellIs the model judging something, or doing what it’s told?

  • Data loss

    Any sensitive business data leaves the organization.

    Privacy

    Harm to people’s personal data, which can happen without a leak.

    The tellWhose data is it: the company’s, or a person’s?

  • Hallucination

    A by-product of how models generate text.

    Poisoning

    An attacker deliberately corrupts the data.

    The tellIs there an attacker behind the wrong answer?

Practice question

Try an objective 2.6 practice question

Pick an answer to see why each option is right or wrong. Every question in our bank works this way.

SY0-801 · 2.6AI threats
Study mode

A company’s general-purpose AI assistant refuses when an employee asks for steps to disable the endpoint protection agent, citing its built-in safety rules. The employee then asks it to play a fictional “unrestricted” assistant and, over several messages, it supplies the steps. Which of the following BEST describes this?

Pick an answer to see why each option is right or wrong.

Takeaway: a user coaxing a model past its own safety rules is jailbreaking; an attacker’s instructions overriding an app’s task, often hidden in content, is prompt injection. Sources: OWASP Top 10 for LLM Applications · NIST AI 100-2 E2025

Take the full Mock Test 1

AI across SY0-801

Where else AI shows up in SY0-801

AI appears in three objectives, each with a different focus.

  1. LLMs as an attack surface

    Where an LLM application can be reached: user prompts, system prompts, retrieved documents, connected tools and plug-ins, model APIs and keys, and outputs other systems consume. The focus: which part is exposed.

  2. The risks of using AI

    What goes wrong once it’s reached: the 13 items above. The focus: naming the threat a situation shows.

  3. AI in security operations

    How a security team uses AI, and limits it: agentic AI, chatbots, predictive analysis and AI-augmented baselines, kept in check by guardrails. The focus: choosing what fits a scenario.

Guardrails named in 4.6, in practice

Choosing a defense against an AI threat is a 4.6 skill, not a 2.6 one. These are the guardrails to know.

  • Approved action lists
  • Human approval for high-impact steps
  • Scope and rate limits
  • Input and output filtering
  • Logging
  • A kill switch

Deepfakes, AI-made audio or video of a real person, are tested as a social-engineering attack under objective 2.5. For every new SY0-801 topic, see SY0-801 vs SY0-701: what changed.

FAQ

AI threats on Security+: FAQ

What is objective 2.6 in SY0-801?

It’s the new SY0-801 objective on threats and weaknesses that come with using AI. It names 13 items, including prompt injection, poisoning, jailbreaking, hallucinations and model manipulation, and sits in Domain 2, which is 24% of the exam.

What is prompt injection on Security+?

Prompt injection is when attacker-written instructions in a model’s input override what the application told the model to do. The instructions can be typed directly or hidden in content the model reads, such as a web page, file or email, and can make it leak data or take unintended actions.

What is the difference between prompt injection and jailbreaking?

Prompt injection overrides an application’s instructions or task, often through hidden content, to leak data or trigger actions. Jailbreaking is a user talking a model out of its own safety rules to get output it’s designed to refuse. Hidden instructions in a page or file point to injection.

Is AI on the Security+ exam?

Yes, in SY0-801. AI risks have their own objective, 2.6; large language models appear as an attack surface in 2.4; and AI capabilities and guardrails for security teams are in 4.6. SY0-701 has no AI objective.

Does SY0-801 ask how to stop AI threats?

Yes, under objective 4.6 rather than 2.6. Objective 2.6 asks you to recognize the threat; 4.6 covers guardrails such as human approval for high-impact actions, input and output filtering, scope limits and logging.

How should I study AI threats for Security+?

Learn what each of the 13 items means, then practice telling look-alikes apart, such as poisoning versus evasion or data loss versus privacy. Practice naming the threat from a short scenario, which is how our 2.6 questions work.

Practice AI threats and the rest of SY0-801

Every mock test includes objective 2.6 questions, with a reason for every option. Mock Test 1 is free and full-length.

Start free Mock Test 1 Domain 2 practice test
Illustration of a magnifying glass over a fan of answer cards, one marked with a tick and one with a cross