Loading story…
Enterprises are reassessing how they deploy AI models as security, resilience, and operational control concerns grow around externally hosted large language models. One report argues that small language models (SLMs) are gaining traction because they can run on-premises, reduce exposure of proprietary data, and better support compliance-sensitive workloads, while still complementing larger models for broader reasoning tasks. The piece frames SLM adoption as a response to board-level concerns over data security, intellectual property protection, and dependence on cloud-hosted AI services.
A separate article warns that reliance on cloud-based LLMs creates concentrated operational and cyber risk, citing the potential for outages, misconfigurations, software defects, and attacks at a small number of hyperscale providers to disrupt many dependent businesses at once. A third reference discusses semantic invariance failure in AI agents, where rewording prompts can produce inconsistent outputs, but it is focused on model robustness research rather than the same enterprise deployment and infrastructure risk discussion. The overall theme is substantive and not fluff because it addresses concrete security, resilience, and reliability risks in enterprise AI adoption rather than promoting products or offering generic advice.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
By March 2026, enterprises were increasingly adopting small language models for specialized workloads because they offer lower cost, lower energy use, and stronger data security, especially for on-premises and edge use in regulated sectors. This reflected a broader response to the risks and limitations of relying solely on large cloud-hosted models.
In 2025, an outage affecting a major LLM provider and its cloud infrastructure caused nearly seven hours of disruption across many dependent services, including legal AI tools, customer service chatbots, and supply chain systems. The incident illustrated the operational fragility created by centralized AI and cloud dependencies.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The widespread adoption of large language models (LLMs) in enterprise environments has introduced significant security challenges, particularly due to the tendency to over-rely on their outputs and the normalization of risky behaviors. Experts warn that treating LLMs as reliable and deterministic can lead to systemic vulnerabilities, as these models are inherently probabilistic and can be manipulated through techniques such as indirect prompt injection. This normalization of deviance—where unsafe practices become accepted due to a lack of immediate negative consequences—mirrors historical safety failures in other industries and is exacerbated when vendors make insecure design decisions by default. In addition to technical risks, human factors play a critical role in LLM security. Employees may inadvertently expose sensitive data by pasting it into public LLMs, blindly trust AI-generated outputs, or bypass security policies for convenience, making internal misuse a primary concern. While technical controls such as AI governance and access restrictions are important, organizations must also prioritize security awareness training to address the human side of LLM risk. Building a culture of responsible AI use is essential to mitigate both external threats and internal errors associated with LLM deployment.
Jun 29, 2026
The widespread integration of large language models (LLMs) into enterprise environments is introducing new security risks at every layer of the technology stack. Security leaders are being urged to rethink traditional trust boundaries, as LLMs can alter assumptions about data handling, application behavior, and internal controls. Key risks include prompt injection, sensitive data leakage through inputs and outputs, and fragmented ownership of LLM-related security responsibilities. Experts emphasize the need to treat LLMs as untrusted compute and to enforce explicit policy and validation layers, rather than relying solely on prompt engineering or fine-tuning. Meanwhile, cybercriminals are actively exploiting the popularity of LLMs by selling discounted access to mainstream AI tools such as ChatGPT, Perplexity, and Gemini on underground forums. These tools are being used by threat actors for a range of malicious activities, including phishing, reconnaissance, and automating cybercrime operations. The criminal use of LLMs lowers the barrier to entry for less-skilled attackers and enables more efficient execution of threat campaigns, highlighting the dual challenge of securing enterprise LLM deployments while monitoring their abuse in the cybercriminal ecosystem.
Jun 29, 2026
Organizations deploying large language model (LLM) applications face significant security and operational risks, including unbounded resource consumption, novel attack vectors, and the need for advanced anomaly detection. Attackers can exploit LLMs by submitting massive, compute-intensive requests, leading to "denial of wallet" attacks that can drain cloud budgets and disrupt business operations. The OWASP Top 10 for LLMs highlights unbounded consumption as a critical vulnerability, emphasizing the importance of implementing resource controls and monitoring usage patterns to prevent financial and service impacts. Additionally, the Model Context Protocol (MCP) introduces new security challenges, as traditional rule-based and signature-based systems are inadequate for detecting sophisticated, context-dependent threats targeting LLM infrastructure. To address these evolving risks, security teams are adopting AI-driven anomaly detection and exposure management strategies that prioritize real, exploitable risks over alert volume. The shift from reactive monitoring to proactive observability and context-aware security is essential for protecting LLM-powered platforms. As threat actors increasingly leverage LLMs to enhance their campaigns, defenders must invest in specialized, security-focused LLMs and scalable infrastructure to keep pace with adversaries and safeguard critical AI assets.
Jun 29, 2026