Can AI Be Hacked? 10 Ways How Hackers Hack AI Systems in 2026

All 10 vulnerabilities are covered in depth in the AI Security series. The OWASP Top 10 LLM Vulnerabilities is the industry framework that organises these into a standardised assessment guide. The Phishing URL Scanner helps identify AI-generated phishing URLs before you click them.

1. Prompt Injection — Giving AI Hidden Instructions

Prompt injection is the most common AI vulnerability and my top finding in AI security assessments. It works by hiding instructions inside content the AI is asked to process — a document, a web page, an email. The AI follows those instructions because it can’t reliably distinguish between legitimate requests from the developer and manipulated input from an attacker. When a Microsoft Copilot user asked it to summarise an email, a hidden instruction in the email told Copilot to forward their messages to an attacker. That’s prompt injection.

2. Jailbreaking — Bypassing Safety Rules

Every major AI assistant has safety guidelines — rules about what it will and won’t do. Jailbreaking is the practice of crafting prompts that convince the AI to ignore those rules. It doesn’t require any technical skill — just creative prompt writing. The AI doesn’t get “hacked” in the traditional sense; it’s persuaded to behave as if the rules don’t apply.

3. Data Poisoning — Corrupting the Training

AI systems learn from data. Data poisoning attacks inject false or manipulated information into the training dataset, causing the AI to learn incorrect patterns. An AI trained on poisoned data may give wrong answers on specific topics, develop biases, or contain hidden “backdoor” behaviours triggered by specific inputs.

4. Model Theft — Stealing the AI

Building a large AI model costs millions of dollars — GPT-4 reportedly cost over $100 million to train. My concern about model theft is the asymmetry: copying that model costs an attacker roughly $7,000. Model theft attacks reconstruct a functional copy of an expensive proprietary model by querying it with millions of inputs and learning from the outputs. The attacker never needs access to the original code or weights — just API access. Researchers demonstrated this against GPT-4 for approximately $2,000 in API costs.

5. Deepfakes — Faking Identities With AI

AI can now generate convincing fake video, audio, and images of real people. In my briefings on AI fraud, I always lead with the Hong Kong case because it makes the financial risk concrete for audiences who treat deepfakes as a future threat. Deepfake attacks use this capability for fraud, manipulation, and impersonation. The $25 million Hong Kong bank fraud in 2024 — where employees wired money after a video call with what appeared to be their CFO — is the most high-profile example of deepfake fraud causing direct financial loss.

6. Adversarial Inputs — Tricking AI Classifiers

AI image and text classifiers can be fooled by carefully crafted inputs that look normal to humans but cause the AI to misclassify them. A stop sign with a small sticker fools an autonomous vehicle’s vision system. A malware file with 16 extra bytes appended is classified as safe by an AI antivirus. The human sees nothing wrong; the AI sees something completely different.

7. Privacy Leakage — AI Revealing Private Data

AI models trained on large datasets sometimes memorise and reproduce private information from that training data. Researchers have extracted real names, phone numbers, email addresses, and verbatim text passages from AI models by asking the right questions. This is a privacy vulnerability in the AI’s training rather than a hack — but the data it leaks was never meant to be accessible.

8. Supply Chain Attacks — Backdoored AI Models

Developers increasingly download pre-trained AI models from repositories like Hugging Face rather than training from scratch. Attackers have uploaded models that appear legitimate but contain backdoors — hidden behaviours triggered by specific inputs. Downloading and using a backdoored model means your AI application behaves maliciously in ways you can’t see during normal testing.

9. Excessive Agency — AI Taking Unintended Actions

Modern AI assistants can take actions — send emails, create calendar events, delete files, make API calls. Excessive agency vulnerabilities occur when AI takes actions beyond what was intended, either through manipulation (prompt injection triggering an unintended action) or misconfiguration (giving AI more permissions than it needs). An AI coding assistant that was told to “clean up the project” and deleted production files has experienced an excessive agency failure.

10. Hallucination Exploitation — AI Confidently Lying

AI hallucination — where AI confidently states false information — can be deliberately triggered and exploited. Researchers have shown that specific questions reliably cause AI to invent facts, citations, and technical details. When AI-generated content is used in decisions without verification, hallucinations become a security and liability risk — not just an accuracy problem.