An organization develops and implements an AI-based plug-in for users that summarizes their individual emails. Which of the following is the GREATEST risk associated with this application?

Question

Options

• ALack of application vulnerability scanning
• BData format incompatibility
• CInsufficient rate limiting for APIs
• DInadequate controls over parameters

• A
  11% (6)
• B
  4% (2)
• C
  4% (2)
• D
  82% (47)

Explanation

An AI email summarization plugin has access to sensitive personal communications. The greatest risk is inadequate controls over parameters (D) - if the plugin's behavior, scope, or inputs can be manipulated (e.g., through prompt injection in a malicious email), an attacker could redirect the AI to exfiltrate content, summarize beyond the intended scope, or perform unintended actions. This is a direct control failure over what the AI does with privileged data. Lack of vulnerability scanning (A) is a general security hygiene issue, not the greatest specific risk here. Data format incompatibility (B) is a technical/operational risk, not a security risk. Insufficient rate limiting (C) is a concern for API abuse but does not address the core risk of the AI itself being manipulated. Parameter control (D) is the most consequential risk given the sensitive data access.

No community discussion yet for this question.