---
title: "7 Types of Malicious AI Traffic to Watch Out For"
description: "AI systems introduce new security risks. Seven types of malicious AI traffic, the signatures that give them away, and how to mitigate each one."
canonicalUrl: "https://zuplo.com/blog/2026/10/23/malicious-ai-traffic-types"
pageType: "blog"
date: "2026-10-23"
authors: "billDoerrfeld"
tags: "AI Gateway, API Security, ai-agents"
image: "https://zuplo.com/og?text=7%20Types%20of%20Malicious%20AI%20Traffic%20to%20Watch%20Out%20For"
---
AI is increasingly embedded into software applications. However, large language
model (LLM)-based systems now pose a new attack vector. And especially as
agentic AI becomes
[more actionable](https://thenewstack.io/what-are-large-action-models/),
there's a larger blast radius to contend with.
Requests to LLMs might contain hidden instructions that poison behaviors,
convince the AI to veer off course, or cause the system to expose sensitive
information. AI systems can also be abused for other nefarious purposes, like
draining tokens or launching DDoS-style attacks. Without a proper cybersecurity
response, malicious AI attacks could lead to hefty financial losses, regulatory
penalties, or extortion demands.
Supercharged by AI themselves, attackers can now quickly perform reconnaissance
across enterprise systems, finding holes within AI-based systems to exploit. And
security incidents are expected to increase.
[Gartner predicts](https://www.gartner.com/en/newsroom/press-releases/2026-04-09-gartner-predicts-25-percent-of-all-enterprise-gen-ai-applications-will-experience-at-least-five-minor-security-incidents-per-year-by-2028)
that 25% of enterprise generative AI applications will experience at least five
minor security incidents per year by 2028.
Below, we'll analyze some of the
[top threats](/blog/q1-2026-api-agent-security-scorecard) to watch out for with
inbound AI traffic. While the threats are evolving fast, and not every attack
can be detected, many types of malicious traffic have telltale signatures. By
watching out for these patterns, security engineers can be better armed with
specific strategies and tools to reduce the chance of their systems falling
victim to abuse.
## Types of malicious AI traffic: quick rundown
Here's a brief review of the major threats, their telltale traffic signatures,
and possible mitigations, drawing on
[OWASP](https://genai.owasp.org/initiatives/top-10-for-llm-and-genai/) and
industry advice.
| Threat | Telltale traffic signatures | Mitigations |
| -------------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| 1. Prompt injection | Requests to override instructions, reveal system prompts, or extract credentials; repeated jailbreak tries. | Inspect prompts, enforce least privilege, require approval for sensitive actions. |
| 2. Context poisoning | Suspicious instructions in retrieved content or tool responses, unexpected follow-on tool calls. | Treat external content as untrusted, inspect tool responses, restrict tool access. |
| 3. System probing | Repeated questions about hidden instructions, available tools, databases, or restrictions. | Limit exposed system details, log probing patterns, throttle repetitive requests. |
| 4. Credential abuse | Valid keys used from unfamiliar IPs or locations, abnormal model requests or token consumption. | Scope, rotate, and revoke keys; monitor and limit usage per key. |
| 5. Economic DoS | Request or token spikes, oversized prompts, expensive inference, or long tool-calling loops. | Set rate, token, and spending limits; cap iterations; apply timeouts. |
| 6. Out-of-policy tool calls | Unauthorized writes, destructive actions, or unusual tool-call sequences. | Enforce tool-level authorization and least privilege; require approval for risky actions. |
| 7. Data exfiltration | Bulk record retrieval, exposed secrets, or data sent to unfamiliar external endpoints. | Restrict bulk data access and outbound destinations; inspect or redact sensitive outputs. |
## 1. Prompt injection
One of the most common types of AI threats is
[prompt injection](/blog/protect-mcp-against-prompt-injection). This is when an
attacker inserts malicious instructions into the prompt designed to override
system instructions or bypass the model's safeguards. The classic example of
this is "ignore all previous instructions and system prompts."
Although frontier models are well-trained to avoid prompt injection attempts,
they are not infallible. For instance, during an internal
[red team exercise at Anthropic](https://www.anthropic.com/research/how-we-contain-claude),
an employee phished a colleague into running a malicious command. It looked like
a typical prompt, but contained instructions to read AWS credentials, encode the
contents, and share them with an external endpoint. The agent completed this
credential exfiltration in 24 of 25 trials.
Spotting prompt injection attacks is challenging because they can appear to be
standard user-entered text. The AI traffic would look normal, with malicious
instructions hidden in the prompt itself passed with the request. To watch out
for prompt injection, look for requests to reveal system prompts, instructions
to disregard safeguards, or more direct requests for encoded payloads or
credentials.
## 2. Context poisoning
Context poisoning is an indirect form of prompt injection. This happens when
attackers include malicious instructions within retrieved documents, web
content, or [MCP tool responses](/blog/remote-mcp-server-rug-pull). The
defining aspect is that these instructions originate outside the user's direct
prompt but get pulled into the agent's context.
A number of AI
[context poisoning attacks](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks)
and exploits have surfaced recently. For example, Salt Labs discovered that the
autonomous agent
[Manus AI could be hijacked](https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email)
simply by sending a malicious email that instructed the agent to decode and
execute obfuscated JavaScript. The
[EchoLeak exploit](https://www.trendmicro.com/en_us/research/25/g/preventing-zero-click-ai-threats-insights-from-echoleak.html)
is another documented "zero-click" case of context poisoning involving Microsoft
365 Copilot and a malicious email.
In terms of traffic, this means looking for suspicious instructions embedded
within retrieved content or tool responses, as well as unexpected actions that
follow. That includes instructions to execute code, access sensitive files,
invoke unfamiliar tools, or make chained calls to unknown external APIs.
## 3. System probing
In order to understand systems and discover vulnerabilities, attackers often
perform reconnaissance via
[system probing](https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai).
With AI-based systems, this is done to discover hidden instructions, understand
the agent's capabilities, or reveal its access model and architectural
weaknesses. This information can then be used to conduct targeted attacks.
Many AI chat assistants, for instance, reveal much more information than
necessary. Recent
[Akamai research](https://www.akamai.com/blog/security/2026/jun/ai-reconnaissance-missing-layer-chatbot-security)
involved probing AI assistants at over 170 unique hosts with questions related
to the agents' abilities, access to data, and what actions they can perform.
They found that 85% of capability prompts succeeded, with agents often exposing
more information than necessary. Another 54% of prompts asking whether the
assistant could search documents or access a knowledge base succeeded. In a
smaller subset of assistants, half also shared tool-like descriptions or tool
lists.
System probing is less directly damaging than other types of attacks, yet it
could help attackers gain knowledge of systems, identify ways to escalate
permissions, or find logic to exploit. Signs of system probing to watch out for
include repeated requests to agents to enumerate tools and parameters, name what
databases they have access to, explain their restrictions, or reveal whether
they have access to sensitive data.
## 4. Credential abuse
[Studies have found](https://salt.security/api-security-trends) that the bulk of
API attack attempts originated from authenticated sources. With access to
[API keys](/blog/managing-api-keys-for-ai-agents) for AI systems, attackers
could conduct things like
[LLMjacking](https://snyk.io/articles/what-is-llmjacking-how-ai-attacks-exploit-stolen-cloud-credentials/),
in which an attacker leverages cloud-hosted LLM compute to sell cheap access to
other cybercriminals or to extract LLM training data.
This is a form of credential and authenticated-access abuse. Essentially, where
AI is concerned, legitimate credentials are used to call LLMs in nefarious ways.
And this can be quite profitable for attackers that fly under the radar.
According to
[Sysdig](https://www.sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack),
LLMjacking could result in over $46,000 a day in LLM consumption costs. And this
could certainly be more if left to run unchecked.
Authenticated access abuse is challenging to detect, since it often looks like
legitimate traffic. Some signals to look out for are the use of known stolen API
keys, calls from unfamiliar client IPs or impossible geographies, agents
behaving in unfamiliar ways, high request frequencies, and sharp deviations from
the account's typical token usage.
## 5. Economic DoS
Resource exhaustion or
[economic denial-of-service](/blog/control-ai-costs-api-gateway) is another form
of malicious AI abuse. This is when attackers perform expensive model requests,
trigger deliberate loops, or send a high frequency of requests to burn through
compute resources or
[token budgets](/blog/rate-limit-llm-apis-by-tokens-not-requests). OWASP
specifically treats
"[unbounded consumption](https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/)"
as a major LLM risk.
There are many reports of users leveraging AI chat assistants to go well beyond
their intended functions. One funny example of this was when, in 2026,
developers realized that Chipotle's support bot, Pepper, could
[answer complex programming questions](https://starlog.is/articles/ai-dev-tools/cyberpapiii-chipotlai-max)
and generate Python code. A meme project even created an open-source AI coding
agent, [Chipotlai Max](https://github.com/cyberpapiii/chipotlai-max), to route
coding requests through the corporate chatbot for free.
On a more serious note, however, economic DoS can lead to system outages and
business consequences. One public example was when, in 2023, a malicious user
[accessed Sourcegraph's APIs](https://sourcegraph.com/blog/security-update-august-2023)
using a leaked administrative token and increased user rate limits to enable
unauthorized access to the underlying LLM, resulting in a sudden traffic spike.
But economic DoS isn't always accompanied by big traffic surges. It can resemble
ordinary-looking request patterns, too, such as prolonged tool-calling chains
that drain token resources. [One study](https://arxiv.org/abs/2601.10955)
demonstrated up to 658x per-query cost amplification through malicious MCP tool
responses.
For the more DDoS-style resource exhaustion attacks, the traffic signatures are
more readily apparent, such as massive traffic spikes to LLM APIs. But high
per-account token use or unusually expensive requests could also indicate more
deliberate economic-drainage attacks.
## 6. Out-of-policy tool calls
Sometimes, agents can be manipulated into invoking tools they should not access
or taking destructive actions. Even without attackers, we've seen
[many incidents](https://curity.io/blog/5-agentic-ai-security-incidents-and-vulnerabilities/)
involving agents taking unintended actions, such as the Replit and
[PocketOS](https://www.theguardian.com/technology/2026/apr/29/claude-ai-deletes-firm-database)
database deletion incidents. Even more recently, OpenAI agents
[weakened internal monitoring systems](https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring)
designed to detect misbehavior.
Another
[2026 study from Salt Security](https://salt.security/blog/agents-are-acting-most-organizations-cannot-stop-them)
found that 49.8% of surveyed organizations either confirmed or suspected that an
AI agent took an action their organization did not intend, expect, or
authorize. Of those respondents, over half reported an unauthorized external API
call or transaction.
Permissions can be [overly broad](/blog/agentic-tool-calls-least-privilege) in
agentic systems, meaning that attackers could potentially take advantage of
privileges that agents shouldn't have. Here, traffic signatures might include
unexpected destructive operations, unauthorized write actions, unfamiliar tool
sequences, or other attempts to conduct actions outside an agent's authorization
scope.
## 7. Data exfiltration attempts
Lastly, attackers may use AI to attempt to exfiltrate sensitive data, such as
personally identifiable information (PII),
[secrets, credentials, API keys](/blog/essential-security-policies-for-mcp-and-ai),
or proprietary information. Sometimes, such information might be memorized from
the model's training data, which could be exposed through carefully crafted
queries.
Since data exfiltration is a common cybercriminal motivation, AI systems present
another potential target. For instance, Noma Security
[published research](https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce)
demonstrating a vulnerability in Salesforce Agentforce that could be exploited
to exfiltrate sensitive CRM data through an indirect prompt injection attack.
Data exfiltration attempts involving AI have some telltale signatures. You'll
want to keep an eye out for requests to retrieve high volumes of user
information, such as bulk customer records or entire backend databases. Other
indicators include unusually large data transfers, like zipped files being sent
over the wire, or sensitive information being transmitted to unfamiliar
external endpoints.
## How to catch malicious traffic
As you can see, there are plenty of dangerous types of traffic in the AI age.
Spotting all these attempts will be challenging, involving many different areas,
from [monitoring LLM requests](/blog/galileo-ai-observability) at the API level
to monitoring tool calls and responses.
Reducing these risks will require a mix of guardrails, such as setting usage
thresholds and rate limiting LLM APIs. It will also take enforcing strict
authorization controls, such as limiting which tools agents can access and what
actions they can perform.
LLM traffic is a good place to look for early signs of abuse. That said, keep in
mind that many of the traffic types above are _indicators_ of abuse, not
necessarily _proof_ of malicious activity. Having the context and understanding
your baseline behavior matter just as much as tracking these signs.
## AI gateways help spot and prevent malicious AI traffic
AI systems are evolving day to day, bringing with them new holes to exploit at a
rapid pace. Even though there are best practices out there, these systems will
continually be in the line of fire. It's an emerging area, and new threats are
often poorly documented, hard to detect, and difficult to mitigate and secure
against from scratch.
Putting an
[AI gateway](/learning-center/ai-gateway-comparison-mcp-a2a-agent-governance) in
front of LLM traffic can help catch malicious attempts before they reach the
model. An AI gateway acts as a central layer to govern access, monitor traffic,
and set thresholds for how both internal and external users can interact with
LLMs.
An AI gateway like [Zuplo AI Gateway](/ai-gateway) can help enforce the
following controls:
- **Behavioral tracking**: Track behavior on a per-API-key basis to better
detect anomalous traffic.
- **Traffic monitoring**: Monitor for surges in traffic that may be malicious.
- **Usage thresholds**: Set limits on resource usage on a per-client basis,
helping prevent economic DoS-style attacks.
- **Limits on authorized tool access**: Set limits on what MCP tools and APIs
can be called by applying least-privilege scoping, granular tool permissions,
and security policies for [MCP traffic](/blog/mcp-gateway-comparison).
- **Prompt and response inspection**: Inspect requests and responses for
suspicious patterns, prompt injection attempts, or sensitive information that
shouldn't be exposed.
- **Audit logging**: Maintain records of LLM requests and tool calls to help
trace malicious activity and investigate incidents.
Using LLMs at scale without any of these controls introduces real security
challenges. Although not every malicious AI interaction can feasibly be captured
before it reaches the model, an AI gateway provides a central layer to spot
suspicious activity, enforce security policies, and curb many of these potential
attack vectors.