{
  "id": 3552298,
  "title": "Every Layer of Your AI Stack Is an Attack Vector. Count Them.",
  "url": "https://urgent.news/2026/08/26/every-layer-of-your-ai-stack-is-an-attack-vector-count-them",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-26T17:17:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/backboardio/every-layer-of-your-ai-stack-is-an-attack-vector-count-them-4mhi"
  },
  "original_language": "en",
  "account": "A typical production AI application comprises 6 to 9 separate vendors, including a model gateway, vector database, memory service, RAG framework, embedding provider, orchestration layer, observability tool, and 2 to 3 model providers. Each vendor adds at least five factors to your attack surface, such as a standing API key, egress path, SDK inside your runtime, log store, and subprocessor on your data processing agreement. Many teams do not thoroughly review the entire stack; they approve each component separately. An AI attack surface includes every point where an attacker can access data, credentials, or compute involved in AI workloads. It has three parts: the model layer (providers your prompts travel to), the data layer (systems that store prompts, embeddings, memories, or retrieved documents), and the integration layer (SDKs, frameworks, and glue services with credentials to the other two). Most teams focus only on the model layer, neglecting the other layers. The typical stack for a production agent has eight vendors, each with an API key, egress destination, security review, subprocessor in your DPA, breach notification clock, and dependency tree. This means eight API keys, eight egress paths, eight security reviews, eight subprocessors, eight breach notification clocks, and eight dependency trees to monitor. Vector databases are often overlooked in security reviews because people assume embeddings are just numbers. However, embedding inversion attacks can reconstruct sensitive text data. Treating the vectors as sensitive transforms the vector database into a second copy of your source data in a different trust boundary, frequently excluded from data inventories. When deleting customer data, you must consider four retention policies across different systems, making deletion proof difficult. The integration layer's supply chain has vulnerabilities, such as the LangChain remote code execution vulnerability and PyTorch dependency confusion attack. Therefore, every framework added increases security risks due to its large dependency tree.",
  "summary": "From the team at Backboard.io . We build AI infrastructure, so we have a position here. We state it at the end, clearly labeled. Everything before that is just counting. TL;DR A typical production AI application runs on 6 to 9 separate vendors: a model gateway, a vector database, a memory service, a RAG framework, an embedding provider, an orchestration layer, an observability tool, and 2 to 3…",
  "key_points": [
    "AI stack comprises 6-9 vendors, each adding 5+ attack surface factors",
    "Attack surface includes model, data, and integration layers",
    "Vector databases often overlooked, but vulnerable to embedding inversion attacks"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}