For decades, enterprise security operated on a stable premise: know your perimeter, patch your endpoints, and audit your access controls. The attack surface was bounded, if not always manageable. The mass deployment of AI workloads - from slottable GPU accelerators like AMD's MI350P to deeply integrated platform agents running inside ServiceNow and Salesforce - has invalidated that premise at speed.

The threat model has not evolved incrementally. It has fractured. A single enterprise AI rollout now introduces model supply chain risk, inference-time prompt injection, hardware-layer side-channel exposure, and agentic privilege escalation - all simultaneously, often without a corresponding control in the existing security stack.

What follows is a field-level assessment of where the gaps are largest, which deployment patterns are generating the highest risk density, and what security teams can realistically do before the next compliance audit forces the conversation.

By the Numbers

The AI Attack Surface: Layer by Layer

The Infrastructure Gap: Hardware Acceleration and the Firmware Blind Spot

AMD's MI350P - its new OCP Accelerator Module-compliant, hot-swappable AI GPU - exemplifies a category of infrastructure change that security teams are consistently late to assess. When a board-level compute unit can be slotted into an existing rack without a formal provisioning cycle, it sidesteps the hardware procurement review that typically triggers a security baseline assessment.

The attack vectors that follow are not theoretical. GPU firmware has been shown to be exploitable for persistent implants that survive OS reinstallation. PCIe DMA (Direct Memory Access) pathways can be abused by a compromised peripheral to read host memory contents - including model weights and inference-time data - without triggering host-side detection. Academic research from 2024 demonstrated viable side-channel attacks against GPU workloads capable of partially recovering private inputs from other tenant workloads in shared inference environments.

Most enterprise endpoint detection and response (EDR) platforms have no visibility into GPU firmware state. Most vulnerability management programs do not include accelerator firmware in their patch cadence. The gap between deployment velocity and security coverage is structural, not operational - it cannot be closed by writing another Jira ticket.

The Integration Problem: When AI Agents Inherit Enterprise Privileges

NVIDIA's push to embed AI agents directly inside ServiceNow workflows - enabling natural-language task execution across ITSM, HR, and procurement modules - is a strategic capability win. It is also a privilege escalation vector that most identity governance teams are not equipped to audit.

Tool-calling AI agents present a fundamentally new authorization challenge. A ServiceNow-embedded agent may hold a service account with broad read-write permissions across the platform - necessary for it to complete tasks autonomously. But that same account, if compromised via prompt injection embedded in a user ticket, becomes a pivot point into any system ServiceNow integrates with: Active Directory, SAP, Workday, and third-party SaaS. The agent's usefulness and its risk profile are derived from the same permission set.

Traditional PAM (Privileged Access Management) solutions manage human users and static service accounts. They have no framework for managing an AI agent whose effective permissions depend on context, instruction history, and the content of documents it processes at runtime. The September 2025 OWASP LLM Top 10 update formally codified indirect prompt injection (OWASP LLM02) as a critical class - but most enterprises have yet to translate that classification into detective or preventive controls inside their existing platforms.

SSRF (Server-Side Request Forgery) via agentic tool calls represents another underappreciated vector: an agent instructed to fetch external content can be manipulated into making internal network requests, probing cloud metadata endpoints (AWS IMDSv1, GCP metadata server), or exfiltrating credentials stored in environment variables accessible to the agent runtime.

The Compliance Vacuum: Frameworks Built for Yesterday's Threat Model

The regulatory landscape for AI security is generating guidance faster than enterprises can implement it - and yet the guidance remains structurally misaligned with the actual deployment patterns creating risk. NIST's AI Risk Management Framework (AI RMF 1.0) provides a governance architecture for managing AI risk across Govern, Map, Measure, and Manage functions. It does not specify what a SIEM rule for prompt injection looks like, what IAM policy correctly scopes an agentic service account, or how to assess model supply chain integrity at the registry level.

The EU AI Act's high-risk classification requirements impose documentation and audit obligations on specific AI application categories - but the attack surface exposures described in this article exist outside application classification. A model serving infrastructure vulnerability affects every application running on that infrastructure regardless of its EU AI Act risk tier.

SOC 2 and ISO 27001 auditors are beginning to ask about AI workloads - but the control frameworks they audit against predate large-scale LLM deployment. In practice, this means that an enterprise can pass a clean SOC 2 Type II audit in 2026 while running AI infrastructure with no prompt injection detection, no model integrity verification, and no agentic privilege boundary controls in place.

The compliance vacuum creates perverse incentives: security teams focus on what auditors check rather than what attackers exploit. Closing this gap requires either waiting for frameworks to catch up - a multi-year process - or proactively building controls against the actual threat model and documenting them as compensating controls in audit packages.

Action Steps for Security and Infrastructure Leaders

Sources