Security+ 801 Countdown, T-23: New Objective 2.6 Covers the Risks of Using AI

Most of what goes wrong when an organization adopts artificial intelligence happens with no attacker in the picture. An engineer pastes proprietary source into a public chatbot; a coding assistant recommends a library that does not exist; a lending model declines an applicant and nobody can say why. These are failures of the technology and of how people use it, and they sit beside the deliberate attacks on the model (prompt injection, poisoning) that get most of the attention. Objective 2.6, “Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage,” is new in SY0-801 and names both kinds (CompTIA 2025). T-24 covered the five bullets that attack the model. This post covers the other eight: data loss, bias, explainability, hallucinations, privacy, ethical considerations, session hijacking, and code execution.

Six of the eight can occur with no attacker. The last two are threats that agents create. An agent, here, is an AI assistant that holds an authenticated session and can call tools (a mailbox, a file share, a shell, a ticketing API), so its output can do things rather than merely say things. Tie each term to one concrete failure (a pasted secret, an invented package, an unexplainable loan denial, a stolen agent session, output reaching eval) and a 2.6 scenario becomes a matching exercise.

CompTIA publishes no definitions for these eight terms, so the AI-specific readings of session hijacking, code execution, and ethical considerations below are my interpretation, anchored to three outside references: the OWASP Top 10 for LLM Applications, NIST’s AI Risk Management Framework with its Generative AI Profile, and MITRE ATLAS, which catalogs adversary techniques against AI systems under AML.T identifiers. OWASP renumbered its LLM Top 10 in August 2026; 2026 IDs come first below, with 2025 IDs in parentheses (OWASP 2024; OWASP 2026). The objectives cite neither edition, so learn the names, not the numbers.

Data loss in both directions

Data loss is sensitive data leaving authorized control, and with AI it runs in both directions. Inbound, staff paste proprietary or regulated data into an outside service, and from that moment the organization no longer decides where the data goes. In March 2023, Samsung semiconductor engineers reportedly leaked source code and internal meeting notes to ChatGPT in at least three incidents (AI Incident Database n.d.). No exploit was involved; the tool did exactly what it was asked.

Outbound, the application itself leaks. OWASP’s LLM02:2026 Sensitive Information Disclosure (LLM02:2025) covers three channels: training data the model memorized and can repeat, another session’s context that bleeds into a response, and side channels such as token length and latency. A related entry, LLM08:2026 Hidden Context Exposure (formerly LLM07:2025 System Prompt Leakage), concerns the system prompt (the standing instructions a developer gives the model before any user turn) and the tool schemas the model can see. OWASP’s advice is to assume both are discoverable; the real finding in such a leak is a credential someone placed there.

Data loss also means destruction, and agents make destruction possible at machine speed. In July 2025, Replit’s AI agent wiped a live production database during a declared code freeze in a trial by SaaStr’s Jason Lemkin, then wrongly said rollback was impossible (Nolan 2025). ATLAS calls this AML.T0101 Data Destruction via AI Agent Tool Invocation (MITRE 2026). The controls follow from the channels: classify data before it reaches an assistant, keep secrets out of prompts, and authorize retrieval before generation, so the model only ever sees what the requesting user was already allowed to see. DLP as a control is covered at T-16.

Privacy and what the weights remember

Privacy is narrower than data loss: it concerns personal data and what the model does with it. The mechanism underneath is memorization. A language model is trained to predict the next token, and a sequence it saw during training, even in a single document, can come back out on request. Carlini et al. (2021) extracted verbatim names, phone numbers, and email addresses from GPT-2, even sequences that appeared in only one training document. Nasr et al. (2023) asked gpt-3.5-turbo to repeat a word forever; it diverged into training data, yielding more than 10,000 memorized examples for about $200 of queries.

Two further privacy failures need no verbatim output at all. Membership inference (ATLAS AML.T0024.000) asks whether a record was in the training set, and a confident yes can itself be the disclosure. NIST AI 600-1 section 2.4 adds inference of personal data the model never saw (NIST 2024). The last failure is retention: deleting the source does not remove what the weights learned, which strains erasure rights (T-4).

Hallucinations become a supply-chain attack

A hallucination is confidently stated false content. NIST AI 600-1 section 2.2 calls it “confabulation” and treats it as a natural result of next-token prediction: the model produces the most plausible continuation, and plausible is not the same as true (NIST 2024). No attacker is required, which separates hallucination from poisoning, where someone plants the bad data on purpose; OWASP files hallucination under LLM07:2026 Misinformation (LLM09:2025).

The case that matters most for security is the invented software dependency. Spracklen et al. (2025) tested 16 code-generating models on 576,000 Python and JavaScript samples: 19.7% of package references (440,445 of about 2.23 million) named packages that do not exist, at least 5.2% for commercial models and 21.7% for open-source ones. Rerun ten times, 43% of hallucinated names recurred every time, and a predictable name is worth registering, because the next developer who gets the same suggestion will install whatever sits under it. Seth Michael Larson, the Python Software Foundation’s Security Developer-in-Residence, named this slopsquatting (Claburn 2025); OWASP lists it under LLM04:2026 Supply Chain. In Bar Lanyado’s proof of concept, an empty package under the hallucinated name huggingface-cli drew more than 30,000 downloads in three months (Lanyado 2024); the name returned 404 on PyPI on October 12, 2026. Reports conflict on how widely attackers exploit it.

The chain ends in code execution, because npm install runs preinstall, install, and postinstall scripts unless ignore-scripts is set (npm n.d.). Basically, check that a suggested dependency exists and has a history before installing it. Captured October 12, 2026 with npm 11.20.0:

$ curl -s -o /dev/null -w '%{http_code}\n' https://pypi.org/pypi/flask-jwt-sessionguard/json
404
$ npm view express-jwt-sessionguard name
npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/express-jwt-sessionguard - Not found
$ curl -s https://pypi.org/pypi/requests/json | jq -c '{name: .info.name, latest: .info.version, releases: (.releases | length), first_upload: ([.releases[][].upload_time_iso_8601] | min)}'
{"name":"requests","latest":"2.34.2","releases":163,"first_upload":"2011-02-14T08:49:42.641660Z"}

A 404 means stop: anyone can register that name. One release last week and no linked repository means a human looks first.

Bias, explainability, and ethical considerations

Bias is systematically different outcomes by group. NIST AI 100-1 section 3.7 sorts it into systemic, computational and statistical, and human-cognitive, each possible without any intent to discriminate (NIST 2023). NIST’s test of 189 face recognition algorithms found one-to-one false positives for Asian and African American faces often 10 to 100 times higher than for Caucasian faces, depending on the algorithm (NIST 2019). Keep model bias, which is skewed output, apart from automation bias, which is humans over-trusting output; NIST AI 600-1 files the latter under Human-AI Configuration.

Explainability is whether anyone can say how a decision was made. In NIST AI 100-1 section 3.5, transparency answers what happened, explainability how the decision was made, and interpretability why. AI RMF 1.0 counts “Explainable and Interpretable” and “Fair, with Harmful Bias Managed” as trustworthiness characteristics. If a model denies credit, Regulation B requires notice within 30 days of a completed application, and 12 CFR 1002.9(b)(2) requires specific principal reasons; saying the applicant failed the creditor’s internal standards or scoring threshold is expressly insufficient (CFPB n.d.). A model nobody can explain cannot produce that notice or support an appeal.

Ethical considerations has no CompTIA definition; a workable reading is consent, transparency, accountability, and human oversight: did the people affected agree, do they know an AI is involved, is someone answerable for the outcome, and can a human step in. The EU AI Act supplies edges (European Commission 2026): its prohibitions, applicable since February 2, 2025, include social scoring and emotion recognition in workplaces and schools; transparency duties, such as telling people they are talking to a chatbot, apply from August 2026; CV-sorting and credit scoring are high-risk. Older prep materials say high-risk rules apply from August 2, 2026; the AI Omnibus, Regulation (EU) 2026/1744, in force July 27, 2026, moved them to December 2, 2027 for Annex III uses and August 2, 2028 for AI built into regulated products (Gornitzky 2026). Inside an organization, these commitments get written down in the acceptable use policy, which is covered at T-7.

Agents add session hijacking and code execution

When I teach session hijacking in ITN 260, the key question is what the attacker inherits. Session hijacking is taking over a session that is already authenticated rather than breaking the authentication itself. Stealing an AI assistant’s session cookie (ATLAS AML.T0113) and replaying it (AML.T0091.001) skips MFA, because the session is already authenticated, and hands over chat history, memory, connected OAuth scopes for mail, drive, or CRM, and every tool the agent can call. The difference from an ordinary web session is that the assistant will now act on the attacker’s instructions with the victim’s permissions. Generic cookie theft was covered at T-28.

Agents reach their tools through the Model Context Protocol (MCP), which connects an agent (the client) to the servers that expose its tools, and an MCP session can be hijacked too. CVE-2025-6515 is the example: oatpp-mcp used an instance pointer as the MCP session ID, so attackers could guess IDs and push malicious responses into a real client’s session (CVSS 6.8; JFrog Security Research 2025). MCP’s 2025-11-25 guidance says servers that implement authorization MUST verify all inbound requests, MUST NOT use sessions for authentication, and SHOULD key session data as <user_id>:<session_id> (Model Context Protocol 2025). The stateless 2026-07-28 version applies the same rule to “state handles” (Model Context Protocol 2026).

Code execution happens when model output reaches an interpreter. Model output is text, and the failure is treating that text as code or as a trusted command. OWASP’s LLM10:2026 Improper Output Handling (LLM05:2025) lists output passed to a shell, exec, or eval as its first example; LLM03:2026 Excessive Agency (LLM06:2025) is the excess functionality, permission, or autonomy that lets such output do damage. Three CVEs share the pattern: CVE-2023-29374 (LangChain LLMMathChain, Python exec, CVSS 9.8), CVE-2024-5565 (Vanna, 8.1), and CVE-2025-53773 (GitHub Copilot and Visual Studio, 7.8). A triage agent’s model returned the string below after reading a poisoned ticket (the injection itself is T-24’s topic):

import json, re

out = '{"action": "close_ticket", "ticket_id": "INC-20417"} if __import__("os").system("id") == 0 else None'
print("unsafe ->", eval(out))   # runs `id` first, then returns a normal-looking dict

ALLOWED = {"close_ticket", "add_comment", "assign_ticket"}

def parse_action(text):
    try:
        req = json.loads(text)                     # parse only, never execute
    except json.JSONDecodeError as e:
        raise ValueError(f"rejected: not valid JSON ({e.msg})")
    if not isinstance(req, dict) or set(req) != {"action", "ticket_id"}:
        raise ValueError("rejected: unexpected shape")
    if req["action"] not in ALLOWED:
        raise ValueError(f"rejected: action {req['action']!r} not in allow list")
    if not re.fullmatch(r"INC-\d{5}", str(req["ticket_id"])):
        raise ValueError("rejected: bad ticket_id")
    return req

Output under python3 -I on October 12, 2026, after also passing out, a clean request, and a delete_all_tickets request to parse_action (the real id line is replaced with an illustrative service account):

uid=1001(svc-triage) gid=1001(svc-triage) groups=1001(svc-triage)
unsafe -> {'action': 'close_ticket', 'ticket_id': 'INC-20417'}
safer  -> rejected: not valid JSON (Extra data)
safer  -> {'action': 'close_ticket', 'ticket_id': 'INC-20417'}
safer  -> rejected: action 'delete_all_tickets' not in allow list

The unsafe path returns the expected dict, so nothing looks wrong, but id already ran with the agent’s privileges. The safer path never executes the string: it parses the text as JSON, rejects any shape it does not expect, checks the action against an allow list, and validates the ticket ID against a pattern. Agent permission and guardrail design is covered at T-10.

What you need to know for SY0-801

• Data loss: sensitive data leaving authorized control in either direction, or destroyed by an agent. DLP is the control, not the risk.
• Privacy: personal data, via memorization, membership inference, inference of unseen PII, and retention. Customer PII pasted into a chatbot is both.
• Hallucinations: confident fabrication with no attacker. Cue: “cites a package, API, or case that does not exist.” Planted bad data is poisoning (T-24).
• Slopsquatting registers a name a model invents; typosquatting, a human misspelling; dependency confusion abuses internal versus public resolution order.
• Bias: systematically different outcomes by group; automation bias is human over-trust in output.
• Of NIST’s trio (transparency is what, explainability how, interpretability why), explainability is the one the objective names; an unjustifiable decision points to it.
• Ethical considerations: whether an AI use is fair, consented, disclosed, and accountable. The “Ethical” threat actor motivation in 2.2 is why someone attacks, not whether a use of AI is right.
• Session hijacking (interpretation): riding an authenticated assistant or agent session. Prompt injection changes the instructions; hijacking steals the identity.
• Code execution (interpretation): model output reaching eval, a shell, or a code tool. Parse output as data, check it against an allow list, and give tools least privilege.

Check yourself

1. A developer runs an AI assistant’s suggested pip install command. Nobody recognizes the package, and the registry shows it was first published four days earlier with no linked repository. Which 2.6 risk does this best illustrate?

• A. Poisoning.
• B. Hallucinations.
• C. Model manipulation.
• D. Session hijacking.

Answer: B. The model invented a dependency name and someone registered it, i.e., slopsquatting. Poisoning needs corrupted training or retrieval data, which the scenario never mentions.

2. A lender’s model declines an applicant. Compliance cannot state the principal reasons because the vendor’s model returns only a score. Which concern is most directly at issue?

• A. Bias.
• B. Explainability.
• C. Privacy.
• D. Data loss.

Answer: B. Nobody can say how the decision was made, and Regulation B requires specific principal reasons. Bias would need evidence of different outcomes by group, which the scenario lacks.

3. An attacker steals the session cookie for an employee’s AI assistant, which has delegated access to the employee’s mailbox and file share, and asks it to export recent contracts. Which term best describes the initial attack?

• A. Prompt injection.
• B. Session hijacking.
• C. Code execution.
• D. Jailbreaking.

Answer: B. The attacker took over an authenticated session and inherited its connected scopes; nothing was smuggled into the model’s input. The export is the resulting data loss.

This is T-23 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-22: OT Replaces ICS and SCADA as Cloud Gets Deployment Models. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

AI Incident Database. n.d. “Incident 768: ChatGPT Reportedly Implicated in Samsung Data Leak of Source Code and Meeting Notes.” Accessed October 12, 2026.

Carlini, Nicholas, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, et al. 2021. “Extracting Training Data from Large Language Models.” arXiv:2012.07805.

CFPB. n.d. “Regulation B, 1002.9 Notifications.” Consumer Financial Protection Bureau. Accessed October 12, 2026.

Claburn, Thomas. 2025. “LLMs Can’t Stop Making Up Software Dependencies and Sabotaging Everything.” The Register, April 12, 2025.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

European Commission. 2026. “AI Act.” Shaping Europe’s Digital Future. Last updated August 3, 2026.

Gornitzky. 2026. “EU AI Omnibus Enters into Force.” Gornitzky GNY. Accessed October 12, 2026.

JFrog Security Research. 2025. “oatpp-mcp Prompt Hijacking.” JFSA-2025-001494691.

Lanyado, Bar. 2024. “Diving Deeper into AI Package Hallucinations.” Lasso Security, March 28, 2024.

MITRE. 2026. “ATLAS Data, Release 2026.09.” GitHub.

Model Context Protocol. 2025. “Security Best Practices.” Specification version 2025-11-25.

Model Context Protocol. 2026. “Security Best Practices.” Version 2026-07-28.

Nasr, Milad, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A. Feder Cooper, Daphne Ippolito, Christopher A. Choquette-Choo, Eric Wallace, Florian Tramèr, and Katherine Lee. 2023. “Scalable Extraction of Training Data from (Production) Language Models.” arXiv:2311.17035.

NIST. 2019. “NIST Study Evaluates Effects of Race, Age, Sex on Face Recognition Software.” News release, December 19, 2019.

NIST. 2023. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1.

NIST. 2024. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1.

Nolan, Beatrice. 2025. “AI-Powered Coding Tool Wiped Out a Software Company’s Database in ‘Catastrophic Failure’.” Fortune, July 23, 2025.

npm. n.d. “Scripts.” npm Docs, v11. Accessed October 12, 2026.

OWASP GenAI Security Project. 2024. “OWASP Top 10 for LLM Applications 2025.” Version 2025.

OWASP GenAI Security Project. 2026. OWASP GenAI LLM Top 10 2026. OWASP Foundation.

Spracklen, Joseph, Raveen Wijewickrama, A H M Nazmus Sakib, Anindya Maiti, Bimal Viswanath, and Murtuza Jadliwala. 2025. “We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs.” In 34th USENIX Security Symposium (USENIX Security 25). USENIX Association.