Threat modeling AI applications

Threat modeling is a structured process for identifying and preparing for security risks early in system design, but AI systems require adapted approaches because they behave unpredictably in ways traditional software does not. AI systems are probabilistic (producing different outputs from the same input), treat text as executable instructions rather than just data, and can amplify failures across connected tools and workflows, creating new attack surfaces like prompt injection (tricking an AI by hiding instructions in its input) and silent data theft that traditional threat models don't address.