An AI threat taxonomy is a structured classification of the ways adversaries can misuse AI systems, models, prompts, agents, and surrounding infrastructure. It groups risks by behavior rather than by a single product or vendor, making it easier to compare threats such as prompt injection, model theft, data leakage, tool abuse, and self-replication.
This matters because AI systems fail in different ways than traditional software. A taxonomy helps defenders decide what to test, what to monitor, and which controls to prioritize, such as input filtering, access control, sandboxing, and runtime logging. In edge and IoT settings, it also reminds teams that model files, orchestration logic, and local runtimes can become payloads. By naming patterns like self-replication and agent hijacking, security teams can look for AI-native abuse before it turns into widespread compromise.