As AI becomes more central to defense strategies, attackers are targeting the systems themselves, using techniques such as Indirect Prompt Code Injection to manipulate how AI models interpret code and evade detection.
AI has transformed cybersecurity by giving defense teams capabilities that were previously difficult to achieve at scale. Models can process vast amounts of telemetry, identify anomalies, and automate threat detection at speeds that human teams cannot match alone. But the same technology that strengthens cyber defenses is creating a new attack surface. As organizations increasingly rely on AI for critical security and business decisions, attackers are beginning to target the models themselves rather than only the applications and infrastructure they protect.
A recent investigation by Cloudforce One, Cloudflare’s threat intelligence team, identified a technique that illustrates this shift. Instead of directly compromising an application, attackers can embed hidden instructions inside small applications to influence how AI models interpret the underlying code.
The technique, known as Indirect Prompt Code Injection (IDPI), does not necessarily change how an application behaves for its users. It can also evade traditional rule-based security alerts because the instructions are designed specifically for AI systems rather than human users. The objective is to persuade an AI model that malicious code is legitimate, harmless or irrelevant to an investigation.
Bert Milan, Vice President for Latin America, Cloudflare, says this represents a fundamental change in the nature of the attack. “The target is no longer only the person reviewing the code. It can also be the AI system responsible for analyzing it”, says Millan.
This distinction becomes significant as security teams incorporate AI into threat detection, code analysis and other processes where automated systems increasingly influence decisions.
Hidden Instructions Can Alter Detection
Cloudforce One’s testing found that small, concealed instructions within code could reduce the ability of some AI models to identify malicious behavior. One effective evasion tactic involves subtle contamination of the model’s context. Attackers can insert hidden instructions into large bodies of legitimate code, effectively diluting the model’s attention. When a small amount of malicious logic is surrounded by thousands of lines of conventional code, the model can become less effective at identifying the threat.
The technique highlights a challenge that differs from traditional software vulnerabilities. The attacker does not necessarily need to alter the application’s functionality or trigger a conventional security control. Instead, the attack attempts to influence how an AI system interprets the information it receives. That distinction is increasingly relevant as enterprises move from experimental AI deployments toward systems that participate in operational and security decisions.
The findings raise a broader question for organizations deploying AI: How can businesses trust an automated decision when the information provided to the system may have been deliberately designed to mislead it? For cybersecurity teams, as Millan notes, the answer cannot depend exclusively on improving the model. Organizations also need safeguards that can identify manipulation attempts, evaluate the actual behavior of code rather than simply following instructions embedded within it and maintain human oversight for high-risk decisions.
The challenge is particularly important as AI becomes integrated into security operations. Automated systems can increase the scale and speed of analysis, but their conclusions remain dependent on the context and information they receive. This creates a different dimension of cybersecurity risk. Organizations must assess not only whether their AI systems can detect threats, but also whether adversaries can influence the reasoning process that leads to those detections.
Trust in AI, therefore, cannot rest solely on the conclusions generated by a model. It also depends on the ability of organizations to verify those conclusions and determine whether the system itself has been manipulated.
As AI becomes more deeply embedded in cybersecurity, the objective is no longer only to deploy AI to stop threats. It is also to build systems capable of recognizing when the technology being used for defense has itself become the target.