RAND Identifies 31 Classes of AI Vulnerabilities, Urging Shift to Structural Security

RAND researchers have unveiled a comprehensive framework for identifying and characterizing security weaknesses in generative artificial intelligence (AI) systems. This new report moves beyond conventional attack taxonomies by systematically dissecting AI architectures—from training data and tokenization to transformer layers and deployment interfaces—to pinpoint where and how vulnerabilities emerge. The study identifies 31 distinct classes of AI vulnerabilities, highlighting that most differ fundamentally from traditional software flaws. These weaknesses often arise from probabilistic learning dynamics, data composition, and optimization trade-offs rather than deterministic code errors. This research is critical for any organization deploying or developing AI, particularly in cloud and DevOps environments. It matters because it reframes the understanding of AI security, shifting the focus from reactive patching of discrete bugs to proactive management of structural risks. For practitioners, this means that simply applying traditional cybersecurity patches or scanning for known exploits will be insufficient. The report underscores that many AI vulnerabilities are only partially patchable, necessitating a more holistic approach that includes architectural safeguards, rigorous provenance validation, and continuous monitoring. This directly impacts the reliability and trustworthiness of AI systems, affecting data scientists, MLOps engineers, and security teams responsible for AI lifecycle management. The findings align with a broader trend in cloud and AI security, where the complexity of distributed systems and autonomous agents demands more sophisticated, integrated security paradigms. As AI models become integral to business operations, their unique threat surface requires specialized attention. This work builds upon the growing recognition that AI safety and security are not merely ethical considerations but fundamental engineering challenges. Previous efforts have focused on prompt injection or data poisoning, but RAND's framework provides a deeper, more architectural view, echoing the shift from perimeter defense to zero-trust principles seen in general cloud security. The proliferation of AI agents and increasingly autonomous systems further amplifies the need for such a structured approach, as these systems interact with critical data and infrastructure in novel ways. In practice, this means organizations must integrate AI-specific vulnerability management into their existing security and development pipelines. Practitioners should prioritize security controls at the data layers, as vulnerabilities in training data, context windows, and retrieval systems pose the highest threat. This includes implementing robust dataset governance, tracking data provenance, and controlling contextual and retrieved inputs. Furthermore, security teams need to adapt their incident response and monitoring strategies to account for AI's unique probabilistic behaviors, moving beyond static rule sets. The recommendation to integrate AI-specific vulnerabilities into global standards suggests that organizations should also advocate for and adopt emerging industry best practices and frameworks tailored to AI, such as ISO/IEC 42001, to systematically manage these evolving risks. Ignoring these structural vulnerabilities could lead to persistent, difficult-to-remediate weaknesses that undermine the integrity and safety of AI deployments.