What Is Frontier AI, and What Are the Security Risks? - Sinevis

On 2 August 2026, the European Commission began enforcing its obligations on general-purpose AI models, with penalties reaching the greater of €15 million or 3% of global annual turnover. A category of technology that was a research curiosity three years ago is now a regulated class of system with named duties and real financial consequences.

That category is usually called frontier AI. For security and risk leaders, it has quietly become a board-level topic — not because of speculative long-term scenarios, but because frontier models are now embedded in the software your organisation buys, the tools your staff use, and increasingly, the capabilities your adversaries can rent by the hour.

This article sets out what frontier AI actually means, what the evidence says about its security risks, and what enterprises should be doing about it now.

What is Frontier AI?

Frontier AI refers to the most capable general-purpose AI models at the cutting edge of what is technically achievable — systems whose capabilities are broad, not narrowly task-specific, and which may display emergent behaviours that were never explicitly trained for but appear as models scale in data, parameters and compute.

That last property is what makes frontier AI a distinct governance problem. With conventional software, capabilities are specified, built and tested. With frontier models, capabilities are discovered — sometimes after release, sometimes by users, and sometimes by attackers.

How regulators draw the line

Because “cutting edge” is not a testable property, regulators have reached for training compute as a proxy:

The EU AI Act presumes a general-purpose AI model carries systemic risk when training compute exceeds 10²⁵ FLOP. Crucially, this is a rebuttable presumption — a provider can argue their model’s capabilities fall short of the state of the art — and it is sufficient but not necessary, so models below the threshold can still be captured on demonstrated capability.
The now-revoked US Executive Order 14110 used a higher bar of 10²⁶ FLOP.

The weakness of compute thresholds is that they age badly. Grok 3, released in February 2025, was the first model to pass 10²⁶ FLOP. Epoch AI projects roughly 30 models above that line by 2027 and more than 200 by 2030. A threshold drawn to capture a handful of exceptional systems is on track to capture a substantial share of the market — which was not the original intent.

The practical takeaway: “frontier” is a moving target. Any internal policy that names specific models or fixed thresholds will be out of date within a year. Anchor your controls to capabilities and access instead.

Why Frontier AI Is a Different Security Problem

Much “AI security” commentary collapses two very different concerns: the risk of using AI systems, and the risk of AI systems being used against you. Frontier models raise both, and they interact.

Three properties drive the difference:

Generality. A frontier model has no fixed function, so it has no fixed threat model. The same system that summarises contracts can also enumerate an attack surface.
Dual-use by default. Capabilities that make a model excellent at secure code review make it excellent at vulnerability discovery. These cannot be separated at the model level.
Agency. Modern deployments give models tools, memory, credentials and the ability to act — turning a text generator into something that touches production systems.

The Security Risks, in Order of Practical Urgency

1. Prompt injection — the unsolved foundational flaw

Prompt injection holds the top spot in the OWASP Top 10 for LLM Applications for the second consecutive edition, and it remains genuinely unsolved. The root cause is architectural: LLMs process instructions and data through the same channel, with no reliable separation between them. An attacker crafts input the model interprets as a new instruction rather than as content to process.

Indirect prompt injection is the enterprise-relevant variant. The model reads untrusted content — a web page, a PDF, an email, a support ticket, a code repository, a knowledge-base article — and that content carries instructions. In retrieval-augmented and agentic systems, the model may treat this hostile external content as trusted direction.

This is not a filtering problem you can buy your way out of. It is a design constraint: assume any content your AI system ingests may be adversarial, and never let model output alone authorise a consequential action.

2. Autonomous agents — where the evidence recently shifted

This is the finding security leaders should pay closest attention to, because it overturns the intuitive worry.

The UK AI Security Institute commissioned RAND to run a randomised controlled trial between September 2025 and January 2026, with 157 participants attempting offensive cyber challenges covering network operations, OS exploitation, and vulnerability discovery. The question: does AI access give lower-skilled attackers meaningful uplift?

The answer was largely no. Participants generally struggled even with AI assistance, the measured uplift was statistically insignificant, and users almost never completed the harder challenges.

But follow-up work with more advanced models produced a very different result. Operating autonomously rather than assisting a human, AI agents solved each capture-the-flag challenge in under an hour with little guidance, for total API costs under US$20.

The risk is not principally that frontier AI makes novices dangerous. It is that capable autonomous agents compress the cost and time of skilled offensive work to near zero. Economics that previously limited how many targets an attacker could pursue no longer apply in the same way.

3. Acceleration of offensive cyber operations

National cyber authorities now report that frontier models meaningfully assist vulnerability analysis, exploit development and reconnaissance. The defensive consequence is a compressed patch window: the interval between a vulnerability becoming known and being exploited at scale is shrinking. Vulnerability management programmes calibrated to 30-day remediation cycles are being outpaced.

4. Data leakage and shadow AI

The most common real-world incident is still the most mundane: staff paste confidential material — source code, customer records, contracts, incident details — into consumer AI tools outside any sanctioned channel. Unlike the risks above, this needs no attacker at all, and most organisations have poor visibility into it.

5. Excessive agency and over-permissioned agents

Give an AI agent more tools than its task requires, broader credentials than it needs, or the ability to act without human approval, and you have created an exploitable path that combines with prompt injection into a full attack chain. Agentic systems compound this through autonomous decision-making, persistent memory, tool and API access, and multi-agent coordination — which is why OWASP published a dedicated Top 10 for Agentic Applications, announced at Black Hat Europe 2025.

The classical control applies with unusual force: least privilege, scoped credentials, and a human in the loop for irreversible actions.

6. AI supply chain and third-party exposure

Your frontier AI exposure is mostly inherited. It arrives through vendors embedding models into products you already use, often without a contract change or an announcement. Model provenance, training-data integrity, fine-tuning pipelines and the security of model weights all sit upstream of you — and outside your direct control.

The Regulatory Picture as of Late 2026

Three jurisdictions matter most, and they have diverged sharply.

European Union — binding and now enforceable. Obligations for general-purpose AI model providers took effect on 2 August 2025. The Commission published a General-Purpose AI Code of Practice on 10 July 2025, structured in three chapters: Transparency, Copyright, and Safety and Security. Formally voluntary, it functions as the practical compliance route. From 2 August 2026, the Commission enforces the full obligations and may levy fines — up to €15 million or 3% of global annual turnover.

United Kingdom — an explicit pivot to security. On 14 February 2025, the AI Safety Institute was renamed the AI Security Institute, announced by the Technology Secretary at the Munich Security Conference. The rebrand signalled a deliberate narrowing towards risks with security implications: malicious cyber attacks, cyber fraud and other cybercrime.

United States — deregulatory, with a security carve-out. Executive Order 14110 was revoked on 20 January 2025. Winning the Race: America’s AI Action Plan followed on 23 July 2025, organised around innovation, infrastructure, and international diplomacy and security. Then on 2 June 2026, a further executive order, Promoting Advanced Artificial Intelligence Innovation and Security, established an AI Cybersecurity Clearinghouse led by Treasury, a classified benchmarking process for model cyber capabilities, and a voluntary early-access framework offering a 30-day federal review before public release. The order states explicitly that nothing in it creates a mandatory licensing, preclearance or permitting requirement.

For multinational organisations the practical implication is that the EU sets the effective floor. Build to the strictest applicable regime rather than maintaining separate control sets.

What Enterprises Should Do Now

Frontier AI risk is not exotic. It is largely an inventory, access-control and third-party problem wearing new clothes.

Build an AI inventory — including what you did not procure. You cannot govern what you cannot see. Cover sanctioned tools, models embedded in existing SaaS, and shadow AI usage. This is the single highest-return first step.
Treat every AI integration point as an untrusted input boundary. Anywhere a model ingests external content is an injection surface. Threat-model it as you would a public API.
Apply least privilege to agents as rigorously as to humans. Scope credentials narrowly, constrain tool access to the task, and require human approval for irreversible or high-value actions.
Compress your remediation cycle. If AI-assisted exploitation is shortening the window between disclosure and exploitation, a 30-day SLA is a risk decision, not a baseline.
Extend third-party risk management to cover AI. Ask vendors which models they use, whether your data trains them, how model updates are tested, and how they handle prompt injection. Most contracts signed before 2024 are silent on all of it.
Map your regulatory obligations deliberately. Most enterprises are deployers rather than providers of general-purpose AI, which carries different and lighter duties — but “lighter” is not “none”, and the distinction is worth establishing on paper.

The Bottom Line

Frontier AI is not a future risk category. It is a present one, with an enforcement deadline that has already passed and an evidence base showing that autonomous agents can now perform skilled offensive work at trivial cost.

The organisations that handle this well will not be the ones with the most sophisticated AI policy document. They will be the ones that know where AI is already running in their estate, who can reach it, what it is permitted to do, and how quickly they can respond when something goes wrong. Those are existing security disciplines — asset inventory, identity and access management, vulnerability management, and third-party risk — applied to a new and fast-moving class of system.

Sinevis works with organisations on exactly these foundations: vulnerability management, third-party risk management, and governance, risk and compliance programmes built to withstand scrutiny. If you are working out where frontier AI fits into your risk register, get in touch.