Test your AI security knowledge

This is indirect prompt injection: the attack arrives through data the AI reads, not through the user. Answer D addresses the impact: even if the model is fooled, it cannot get the data out without a person approving the action.

A helps but is not enough: an instruction in the prompt can be bypassed, it is not a security boundary. B guarantees nothing, since no model is immune. C protects stored data, not what the assistant does with it once it has read it.

Excessive agency means an AI has more functions, permissions or autonomy than it needs. Here, the administrator token turns any manipulation of the agent into a high-impact action across the whole CRM.

The fix is the principle of least privilege: a dedicated account limited to the operations the agent actually needs. The other answers are real risks, but this permission choice does not create them.

Data poisoning happens during training or fine-tuning: the attacker changes what the model learns. The timing of the attack is what sets it apart from the others.

Evasion (A) targets a model that is already trained, by feeding it a modified input to fool it at inference time. Model inversion (B) tries to reconstruct training data from the model’s answers. Membership inference (D) tries to find out whether a specific record was part of the training data.

Governance comes first. Without a policy approved by management, there is no clear rule to enforce and no basis for choosing technical controls. Answer A also meets the business need by offering approved tools.

B moves the problem to personal devices and ignores what employees need. C is premature, since no rule was ever communicated. D is a good technical control, but it supports a policy, it does not replace one.

Québec’s private-sector privacy act, as amended by Law 25, requires the business to inform the person of a decision based exclusively on automated processing. On request, it must also explain the information used, the reasons and the main factors behind the decision, and let the person submit observations to someone who can review the decision.

ISO/IEC 42001 (A) is a voluntary standard. The Commission d’accès à l’information (B) does not approve algorithms in advance. Hosting location (D) does not change this obligation.