AI Model Risk Depends on What the Model Can Reach

New Snyk research across thousands of scanned enterprise environments shows why a high model-risk score marks where triage begins, and how security teams should respond. Imagine two applications that reference the same AI model.

What happened

New Snyk research across thousands of scanned enterprise environments shows why a high model-risk score marks where triage begins, and how security teams should respond.

Where the sources line up

Imagine two applications that reference the same AI model. One summarizes meeting notes, and the other uses an agent to query customer records and trigger business workflows. The model might carry the same adversarial test scores into both applications. But the consequences of a failure could be very different, and so could the failure that matters. A meeting summarizer needs to know whether the model can be pushed into misleading output. A customer records agent needs to know whether it can be made to leak data or take unauthorized actions. That’s why a model score for each type of attack is more useful than one average across all of them.

Practical impact for readers

That distinction is at the heart of Snyk’s 2026 State of Agentic AI Adoption, Volume III . The first two volumes established that enterprise AI is a connected software estate, not just a collection of models. This new analysis adds risk scores for identifiable models and asks the question security leaders actually need answered: Which findings require action, and what action will reduce the risk?

Who should pay attention now

How the scores work: Snyk tests each model against 29 attacker goals, such as extracting personal data or executing commands, and scores each from 0 to 1,000. The score combines how often an attack succeeded with how much damage that goal could do. 500 and above is high, 750 and above is critical. Models are tested behind a basic guardrail, so the scores describe a defended model, not an undefended one.

What is still unclear

Those numbers should prompt investigation, not panic. The research matches model identifiers found in code to adversarial test results. It does not establish that every model is active in production, that a particular tool or dataset is accessible, or that an attack has succeeded in an organization's application.

Source notes

Snyk Security Labs