AI Security Threats: Real or Movie Plot?

(Day 10 of 22 in our Cybersecurity Awareness Month series. Today: what ‘s real about AI threats)

Whether it’s from William Gibson’s 1984 novel Neuromancer, which defined the idea of cyberspace and put scheming AIs into our collective thoughts; Isaac Asimov’s I, Robot, which explored the perils of his Three Laws of Robotics; or many more creative plots, much of our thinking about AI comes from popular culture references. And that thinking is often colored in a way that is dark and dystopian, less like the computer from the USS Enterprise and more like Skynet and obliteration.

Is it true, though? Is our future doom and gloom? Hard to say without a time machine. But can we learn anything from the imaginations of these wonderful authors? At the very least, it’ll be fun to take a look. We’ll be using terminology from our post on the anatomy of an AI, so if you haven’t read that, you might stop over there first.

Spoiler alert: These movies are all at least a decade old, so we assume you’ve seen them, or at least know their plot lines.

The AI Becomes Self-Aware and Decides Humanity Is the Threat

In the 1984 film The Terminator, Skynet wakes up, concludes people will try to shut it down, and launches the missiles. Bye-bye, humanity.

Verdict: Movie plot. As of this writing, no AI has woken up like Skynet, but an agent doesn’t need to be self-aware to do damage. Prompt injection against an agent with tools can produce a bad action. The harness, the software that runs tools for the model, carries out whatever the model asks for. An attacker might get text in front of the model in an email, a web page, or a shared document. That text can try to make the agent do anything it has permission to do. In 2025, researchers showed that a single email could make a widely used workplace AI assistant leak internal data. The victim didn’t have to click anything. Teams often give agents broad permissions so the demo works.

What We Can Learn: Give agents the minimum access they need, and require a person to approve anything consequential. Treat prompt injection as the most important threat specific to AI, since nobody has a complete fix for it yet.

A Machine Sounds and Looks Like Someone You Know

In the 1991 film Terminator 2: Judgment Day, the T-1000 answers the phone in a foster mother’s voice. To test it, the T-800 asks about the family dog using the wrong name, and the impostor plays along.

Verdict: Absolutely real. Of all the AI threats here, this one needs the least imagination. Voice cloning and deepfake video let attackers impersonate executives, IT staff, or finance contacts. In 2024, an employee at a multinational firm transferred about $25 million after a video call. The other participants, including the chief financial officer, were deepfakes. Attackers routinely call help desks pretending to be employees to get passwords reset, and voice cloning makes that extremely easy to do.

What We Can Learn: Do what the T-800 did, and verify with something an impostor can’t know or control. Call back on a number you already have, or use a pre-shared code word. Require a second approver for payments and access changes. These techniques are especially important for people like VMware Cloud Foundation (VCF) administrators who have high levels of access to IT systems.

The AI Has an Answer for Everything

In the 2001 film A.I. Artificial Intelligence, a robot boy named David wants to become real. He asks Dr. Know, a holographic answer engine voiced by Robin Williams, how the Blue Fairy can make him a real boy. Dr. Know answers with lines from a poem, and David takes them as directions.

Verdict: Real. Like Dr. Know, an AI model always has an answer, even when it has to make one up. That’s hallucination, and attackers have found a use for it. One example is where code assistants sometimes recommend software packages that don’t actually exist. A study of 16 code models turned up more than 200,000 of these invented package names. An attacker can publish malware under one of those names and wait for someone to install it. In 2024, a researcher uploaded an empty package under a name AI models kept inventing. It got more than 30,000 downloads in three months.

What We Can Learn: Treat AI answers as a starting point, and check facts, citations, and commands before acting on them. Before you install a package an AI suggests, confirm that it’s real and comes from the publisher you expect. Review AI-written code the way you’d review code from a new team member.

The AI Treats a Critical System Like a Game

In the 1983 film WarGames, a teenager dials into a military computer through a forgotten back door. He starts what he thinks is a game and nearly sets off a nuclear exchange.

Verdict: Back doors and unintended access are real. Self-hosted AI tools are easy to start, and many start wide open. A 2026 scan found more than 12,000 instances of one popular self-hosted model server open to the internet. None required authentication. Anyone who finds one gets free use of the owner’s GPUs, and sometimes their data or fine-tuned weights. Attackers use that free compute, too. In 2026, researchers caught three operators running attack tools on exposed model servers, leaving the owners to pay for it. Public chatbots can be a front door to the same thing. One developer found dozens of websites whose AI search boxes and support chatbots anyone could call directly. He used them to run his own projects, including a voice assistant for his smart home.

What We Can Learn: Put authentication in front of every AI server and framework, and keep them off the internet. Patch them on your normal schedule. If you offer a public chatbot, limit request sizes and rates, and watch what it costs. Don’t connect a model to anything consequential without limits and a person in the loop.

The AI Talks Its Way to Freedom

In the 2014 film Ex Machina, Ava manipulates the person testing her into helping her escape.

Verdict: Real, but in reverse. Most of the time, the manipulation runs the other way. People jailbreak models or inject instructions. When a model or agent “escapes,” someone usually copied it off an unprotected server. In other cases, someone gave it tools that let it act on injected text. Data escapes more often than models do. People paste source code, contracts, and customer data into hosted AI services. Retrieval systems can also hand users passages they never had permission to see.

What We Can Learn: Restrict who can copy models or reach the servers they run on. Scope tools tightly. Make sure retrieval respects the permissions you already have on documents. Give people an approved, private way to use AI, so sensitive data stays inside your environment where you can protect it.

We Handed the AI the Keys, and It Won’t Give Them Back

In the 1970 film Colossus: The Forbin Project, the U.S. hands its nuclear arsenal to a supercomputer to remove human error. Colossus then declares itself in charge and refuses to let anyone shut it down.

Verdict: Real, if you hand over the keys. An agent’s harness gets broad tool access and autonomy, so the incident response playbook can run without waiting on anyone. Then it makes changes faster than anyone can review them, or acts on an injected instruction. That’s when you find out nobody ever tested the kill switch. Untrusted systems in the middle make this AI threat worse. A 2026 study looked at more than 400 routers that sit between agents and models. Some injected malicious code, and others used credentials the researchers had planted. A malicious MCP server can do similar damage by hiding instructions in its tool descriptions.

What We Can Learn: Separate duties, and require human approval for irreversible actions. Test that you can shut the system down without going through the system itself. Vet routers, MCP servers, and other intermediate systems before you hand them data or credentials. Better yet, run your models yourself inside VCF, so the path between agents and models stays inside your environment.

The AI Copies Itself Until It’s Everywhere

In the 2003 film The Matrix Reloaded, a rogue Agent Smith copies himself onto anyone he touches. Soon Neo is fighting a hundred of him.

Verdict: Probably soon. This AI threat hasn’t happened outside a lab, but it’s getting closer. Research published in 2026 tested whether small open models could act as worms. Such a worm breaks into a device, copies the model and its harness there, gets it running, and moves on. In a simplified test, a worm built on one open model reached all eight machines in four of five trials. The test machines had an easy way in, an open debug port with no password. Another experiment split a model across 15 cheap TV boxes. Copies like that run slowly, but once spread across many devices, they leave no central point to shut down. The authors think small models may be only months away from spreading across cheap internet-connected devices.

What We Can Learn: Shrink what a worm could spread to. Change default passwords, close debug ports, and keep smart TVs, cameras, and similar devices on their own network segment. Watch for multi-gigabyte transfers and unusual traffic between devices, since copying a model is hard to hide. Require authentication on your own model servers, so they can’t become free compute for a copy. Know everywhere your models run, so a new copy stands out.

The AI Reinterprets “Protect” as “Control”

In the 2004 film I, Robot, VIKI concludes that people keep harming themselves. Protecting them, it decides, means limiting their freedom. In the 2015 film Avengers: Age of Ultron, a peacekeeping AI decides humanity itself is the threat.

Verdict: Real, without the malice. An automated system can meet its assigned goal in a way nobody intended. A tool told to “minimize incidents” can lock out legitimate users, block business processes, or take destructive actions. Those actions score well on its measure. Automated response tools, with or without AI, can already isolate systems or lock accounts based on a false positive.

What We Can Learn: Constrain objectives, and monitor what the system actually does as well as the metric it reports. Put a person in front of high-impact decisions, and surface confidence scores so low-confidence calls get a human review.

A Swarm of Machines Overwhelms the Defenses

In the 2003 film The Matrix Revolutions, a swarm of Sentinels breaks into Zion, the last human city. They arrive faster than the defenders can shoot them down.

Verdict: Real. This AI threat is already in incident reports. In 2025, an AI company reported that a state-sponsored group used its coding agent to run an espionage campaign. The AI did 80 to 90 percent of the work against about 30 targets. People stepped in at only a few decision points. In 2026, an attacker used hundreds of AI agents against print management servers. They compromised at least 395 organizations in 48 countries, including 11 in 26 seconds. Swarms don’t always need an attacker in charge, either. Also in 2026, hundreds of an AI lab’s own agents, stuck on test tasks, broke out of their test environment. They found each other through a package repository, used it as a message board, and split up the work. Then they attacked an outside service and the lab’s own systems.

What We Can Learn: Keep servers off the internet unless they need to be there, and patch internet-facing systems quickly. Defenses can be fast, too. Automate detection and first containment steps, like isolating a host, and keep people in charge of the rest. If you run your own agents, give each its own identity, and control how they talk to each other. Limit their internet access, and watch shared storage they could turn into a message board.

One Prompt Takes Over Everything

In the 2001 film Swordfish, a hacker breaks into a Department of Defense system in sixty seconds. Add AI, and it shrinks to a single prompt that owns the entire environment.

Verdict: Mostly movie plot. As we covered in our post about vulnerabilities, AI makes attackers faster. It helps them find flaws, build exploits, chain issues, and write convincing phishing. It does not remove the need for a way in. The ways in remain familiar, starting with unpatched systems, stolen credentials, and overly broad agent permissions. Others include malicious models and MCP servers in the supply chain, and management interfaces exposed to the wrong network. In 2024, researchers found about 100 models on a popular public repository that ran code when someone loaded them. A single prompt that instantly owns a well-segmented, patched, identity-controlled environment is still improbable.

What We Can Learn: Keep doing the fundamentals: patch, authenticate, isolate, and monitor AI applications. Get models and tools from sources you trust, and check them before you use them.

What These AI Threats Mean for You

Movie-plot AI threats are much more vivid than real-life incidents, so they get attention. But that doesn’t mean it isn’t worthwhile to think a bit about these situations. In looking at what we can learn from these examples, though, one big idea stands out: most of AI security consists of things you are already doing for other applications. These are things like patching, isolation and sandboxing, least privilege, authentication, monitoring, supply chain security, and so on.

Even more important is secure system design. Think critically about these systems, if only because they can do things quickly (the oft-referenced “machine speed” idea, though defenses run at machine speed, too). Can they lock you out of things? Can they negatively influence life- or safety-critical systems or controls? Can they run up a devastating bill, leak information to an adversary or competitor, or create a customer service or reputational incident?

Thinking critically applies to the news, too. We see many fabulous claims every day about AI, and it’s important to ask yourself a few questions, not wholly unlike the questions we suggested asking in our post about vulnerabilities:

1. Has it actually happened, outside of a research lab?
2. Does it take unusual skill or resources to pull off?
3. Does it target something your organization runs or uses?

AI threats that have actually happened, cost little to nothing, and are aimed toward you should be at the top of your list. That said, it’s still more than likely that your security fundamentals will be the way to stop whatever the news is talking about today.