What Is Frontier AI, and What Are the Security Risks? - Sinevis

On 2 August 2026, the European Commission’s power to fine providers of general-purpose AI models took effect, with penalties of up to €15 million or 3% of worldwide annual turnover, whichever is higher. A category of technology that was a research curiosity three years ago is now a regulated class of system with named duties and real financial consequences.

That category is usually called frontier AI. For security and risk leaders it has quietly become a board-level topic. The reason is not speculative long-term scenarios. It is that frontier models are now embedded in the software your organisation buys, the tools your staff use and, increasingly, the capabilities your adversaries can rent by the hour.

This article sets out what frontier AI actually means, what the evidence says about its security risks, and what enterprises should be doing about it now.

What is Frontier AI?

Frontier AI refers to the most capable general-purpose AI models at the cutting edge of what is technically achievable. These systems have broad rather than narrowly task-specific capabilities, and they may display emergent behaviours that were never explicitly trained for but appear as models scale in data, parameters and compute.

That last property is what makes frontier AI a distinct governance problem. With conventional software, capabilities are specified, built and tested. With frontier models, capabilities are discovered: sometimes after release, sometimes by users, and sometimes by attackers.

How regulators draw the line

Because “cutting edge” is not a testable property, regulators have reached for training compute as a proxy:

The EU AI Act (Article 51) presumes a general-purpose AI model has high-impact capabilities, and therefore systemic risk, when its cumulative training compute exceeds 10²⁵ FLOP. The presumption is rebuttable: a provider can argue that, exceptionally, its model does not present systemic risk. It is also sufficient but not necessary, because the Commission can designate models below the threshold on the basis of their capabilities.
The now-revoked US Executive Order 14110 used a higher bar of 10²⁶ FLOP.

The weakness of compute thresholds is that they age badly. Epoch AI estimates that the first model to pass 10²⁶ FLOP was xAI’s Grok 3, released in February 2025. Its May 2025 projections put the number of models above that line at around 30 by the start of 2027 (a range of roughly 10 to 80) and more than 200 by 2030. A threshold drawn to capture a handful of exceptional systems is on track to capture a substantial share of the market, which was not the original intent.

The practical takeaway: “frontier” is a moving target. Any internal policy that names specific models or fixed thresholds will be out of date within a year. Anchor your controls to capabilities and access instead.

Why Frontier AI Is a Different Security Problem

Much “AI security” commentary collapses two very different concerns: the risk of using AI systems, and the risk of AI systems being used against you. Frontier models raise both, and they interact.

Three properties drive the difference:

Generality. A frontier model has no fixed function, so it has no fixed threat model. The same system that summarises contracts can also enumerate an attack surface.
Dual-use by default. Capabilities that make a model excellent at secure code review make it excellent at vulnerability discovery. These cannot be separated at the model level.
Agency. Modern deployments give models tools, memory, credentials and the ability to act. That turns a text generator into something that touches production systems.

The Security Risks, in Order of Practical Urgency

1. Prompt injection: the unsolved foundational flaw

Prompt injection is ranked first in the OWASP Top 10 for LLM Applications 2026, released by the OWASP GenAI Security Project in August 2026, as it has been in every edition since the list first appeared in 2023. It remains genuinely unsolved. The root cause is architectural: LLMs process instructions and data through the same channel, with no reliable separation between them. An attacker crafts input that the model interprets as a new instruction rather than as content to process.

Indirect prompt injection is the enterprise-relevant variant. The model reads untrusted content (a web page, a PDF, an email, a support ticket, a code repository, a knowledge-base article) and that content carries instructions. In retrieval-augmented and agentic systems, the model may treat this hostile external content as trusted direction.

This is not a filtering problem you can buy your way out of. It is a design constraint: assume any content your AI system ingests may be adversarial, and never let model output alone authorise a consequential action.

2. Autonomous agents: where the evidence recently shifted

This is the finding security leaders should pay closest attention to, because it overturns the intuitive worry.

The UK AI Security Institute commissioned RAND to run a randomised controlled trial between September 2025 and January 2026, with 157 participants attempting offensive cyber challenges covering network operations, operating system exploitation, and vulnerability discovery and exploitation. Half had access to frontier models (including OpenAI o3 and GPT-5, Anthropic Claude Opus 4.1 and Google Gemini 2.5 Pro). The question: does AI access give lower-skilled attackers meaningful uplift?

The answer was largely no. In the report, published on 28 May 2026, participants generally struggled even with AI assistance, the measured uplift was statistically insignificant, and users almost never completed the harder challenges.

Follow-up work published by RAND on 25 June 2026 produced a very different result. Re-running the same challenges with Claude Code, using Anthropic’s Sonnet and Opus 4.6 models as of April 2026, the researchers found that the AI agent solved each capture-the-flag challenge in under an hour with little guidance, for total API costs of less than US$20 across all of the challenges, using straightforward prompts from people without meaningful cyber knowledge.

The risk is not principally that frontier AI makes novices dangerous through a chatbot. It is that capable autonomous agents compress the cost and time of skilled offensive work towards zero. Economics that previously limited how many targets an attacker could pursue no longer apply in the same way.

3. Acceleration of offensive cyber operations

The RAND study notes that frontier models are increasingly capable of supporting offensive tasks such as vulnerability analysis, exploit development and reconnaissance, and that the first real-world cases of misuse have been observed. The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) made a related point in April 2026: frontier models are not creating new vulnerabilities but identifying ones that already exist. The defensive consequence is a compressed patch window. If attackers can find and weaponise existing flaws more cheaply, vulnerability management programmes calibrated to 30-day remediation cycles will be outpaced. The ACSC’s own advice reflects this: it asks organisations to adopt “a patch every day mentality”, particularly for internet-facing systems, and to consider applying patches regardless of severity rating, because lower-severity flaws can be chained together (ASD’s ACSC, Frontier models and their impact on cyber security).

4. Data leakage and shadow AI

The most common real-world incident is still the most mundane: staff paste confidential material (source code, customer records, contracts, incident details) into consumer AI tools outside any sanctioned channel. Unlike the risks above, this needs no attacker at all, and most organisations have poor visibility into it.

5. Excessive agency and over-permissioned agents

Give an AI agent more tools than its task requires, broader credentials than it needs, or the ability to act without human approval, and you have created an exploitable path that combines with prompt injection into a full attack chain. Agentic systems compound this through autonomous decision-making, persistent memory, tool and API access, and multi-agent coordination. That is why the OWASP GenAI Security Project published a dedicated Top 10 for Agentic Applications for 2026 on 9 December 2025, headed by agent goal hijack, and why Excessive Agency rose from sixth to third place in the 2026 LLM list.

The classical control applies with unusual force: least privilege, scoped credentials, and a human in the loop for irreversible actions.

6. AI supply chain and third-party exposure

Your frontier AI exposure is mostly inherited. It arrives through vendors embedding models into products you already use, often without a contract change or an announcement. Model provenance, training-data integrity, fine-tuning pipelines and the security of model weights all sit upstream of you, and outside your direct control.

The Regulatory Picture as of Late 2026

Three jurisdictions matter most, and they have diverged sharply.

European Union: binding and now enforceable. Obligations for general-purpose AI model providers took effect on 2 August 2025. The Commission published a General-Purpose AI Code of Practice on 10 July 2025, structured in three chapters: Transparency, Copyright, and Safety and Security (the last applying only to providers of models with systemic risk). It is formally voluntary, but the Commission and the AI Board have confirmed it as an adequate tool for demonstrating compliance, so in practice it is the main compliance route. From 2 August 2026, the Commission can enforce those obligations and fine providers up to €15 million or 3% of worldwide annual turnover, whichever is higher (Article 101). Models placed on the market before 2 August 2025 have until 2 August 2027 to comply. Separately, the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) deferred the high-risk system obligations to 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI in regulated products, but it did not delay the general-purpose AI regime.

United Kingdom: an explicit pivot to security. On 14 February 2025, the AI Safety Institute was renamed the AI Security Institute, announced by the then Technology Secretary, Peter Kyle, at the Munich Security Conference. The rebrand signalled a deliberate narrowing towards risks with security implications, such as the use of AI to develop chemical and biological weapons, carry out cyber attacks and enable fraud and child sexual abuse, rather than bias or freedom of speech.

United States: deregulatory, with a security carve-out. Executive Order 14110 was revoked on 20 January 2025. Winning the Race: America’s AI Action Plan followed on 23 July 2025, organised around innovation, infrastructure, and international diplomacy and security. Then on 2 June 2026, Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security, directed Treasury to form an AI cybersecurity clearinghouse in voluntary collaboration with industry and critical infrastructure operators, required a classified benchmarking process for the cyber capabilities of AI models, and set up a voluntary early-access framework under which developers give the government access to covered frontier models for up to 30 days before releasing them to other trusted partners. The order states that nothing in it authorises a mandatory licensing, preclearance or permitting requirement.

For multinational organisations the practical implication is that the EU sets the effective floor. Build to the strictest applicable regime rather than maintaining separate control sets.

What Enterprises Should Do Now

Frontier AI risk is not exotic. It is largely an inventory, access-control and third-party problem wearing new clothes.

Build an AI inventory, including what you did not procure. You cannot govern what you cannot see. Cover sanctioned tools, models embedded in existing SaaS, and shadow AI usage. This is the single highest-return first step.
Treat every AI integration point as an untrusted input boundary. Anywhere a model ingests external content is an injection surface. Threat-model it as you would a public API.
Apply least privilege to agents as rigorously as to humans. Scope credentials narrowly, constrain tool access to the task, and require human approval for irreversible or high-value actions.
Compress your remediation cycle. If AI-assisted exploitation is shortening the window between disclosure and exploitation, a 30-day SLA is a risk decision, not a baseline.
Extend third-party risk management to cover AI. Ask vendors which models they use, whether your data trains them, how model updates are tested, and how they handle prompt injection. Many contracts signed before the current wave of AI features are silent on all of it.
Map your regulatory obligations deliberately. Most enterprises are deployers rather than providers of general-purpose AI, which carries different and lighter duties. But “lighter” is not “none”, and the distinction is worth establishing on paper.

The Bottom Line

Frontier AI is not a future risk category. It is a present one, with an enforcement date that has already passed and an evidence base showing that autonomous agents can now perform skilled offensive work at trivial cost.

The organisations that handle this well will not be the ones with the most sophisticated AI policy document. They will be the ones that know where AI is already running in their estate, who can reach it, what it is permitted to do, and how quickly they can respond when something goes wrong. Those are existing security disciplines (asset inventory, identity and access management, vulnerability management and third-party risk) applied to a new and fast-moving class of system.

Sinevis works with organisations on these foundations: AI security, vulnerability management, and the data security controls (discovery, classification, encryption and key management) that decide what AI systems can reach. If you are working out where frontier AI fits into your risk register, get in touch.