AI infrastructure risks are now concrete enough for a classroom lesson built around evidence rather than fear. As of October 22, 2026, the research record supplied for this lesson points to several measurable concerns: government services faced a larger share of observed threat activity, phishing grew as an intrusion method, identity weaknesses were repeatedly connected to attacker success, and supply-chain compromises affected software packages used in AI-related environments. The teaching goal is not to train students in attack methods. It is to help them read a threat report, separate claims from evidence, and explain how a technical system can be exposed through people, packages, credentials, and configuration choices.
Teaching AI Infrastructure Risks With Evidence
AI Infrastructure Risks Framing Question
Start the class with a single framing question: what evidence would show that an AI service is exposed to security risk? The phrase AI infrastructure risks should be treated broadly enough to include model access points, identity systems, developer repositories, third-party packages, cloud services, and operational logging. That definition keeps the lesson grounded in systems thinking. A model may be the visible part of the service, but the risk may enter through credentials, dependency updates, administrative access, or an employee workflow.
Use the Microsoft data as the opening evidence set. In 2026, government agencies and services accounted for 27% of observed threat activity, compared with 17% in 2025, according to the Microsoft Digital Defense Report 2026. The same report noted that phishing accounted for 23% of observed intrusion methods in 2026, up from 7% in 2025, and that 52.2% of intrusions involving valid accounts also led to additional credential theft. Those figures give students a defensible reason to discuss identity and phishing before they discuss more dramatic scenarios.
Learning Goals And Boundaries
The lesson should produce three skills. Students should be able to identify the asset at risk, describe the evidence that supports the risk claim, and propose a defensive control category without giving offensive instructions. For example, a claim about credential theft can lead to discussion of account inventory, access review, multifactor authentication, and incident response records. It should not lead to demonstrations of credential harvesting or bypass steps.
- Students classify risk domains: identity, supply chain, phishing, model exposure, and operational monitoring.
- Students connect one statistic or incident to one defensive question.
- Students write a short risk statement that includes evidence, affected stakeholders, and uncertainty.
- Students avoid claims that are not supported by the provided evidence set.
Teachers can pair this risk-analysis session with a related lesson on defensive lab controls if students need more practice separating safe investigation from harmful technical detail. For younger learners or mixed-age technology clubs, engaging activities from Camp Techwise lay the groundwork for understanding basic concepts before students tackle formal cyber reports.
Evidence Set For AI Infrastructure Risks
Current Threat Signals
The research notes give the class several current signals to analyze. From January 2025 to June 2026, 25.5% of all cyber threat activity impacted U.S. customers, with IT, government, and academia among the top affected sectors, according to Microsoft’s Digital Defense Report. That statistic matters in a classroom because many AI systems depend on the same organizations for hosting, administration, research, procurement, or public service delivery.
Other supplied research widens the evidence base. A TELUS Digital study published in May 2026 reported that all 34 AI models tested across 10 providers were exploitable, with attack success rates ranging from 1.3% to nearly 93%, and most widely used production models above 40%. IBM’s 2026 breach report, covering breaches between March 2025 and February 2026, found that 1 in 4 malicious breaches were AI-enabled and averaged $6 million in cost, compared with a $4.99 million global average breach. These figures should be handled carefully. They indicate risk signals in the tested or studied populations; they do not prove that every deployment has the same exposure.
Sorting Evidence By Risk Domain
By placing AI infrastructure risks into domains, students can avoid treating every cyber event as the same kind of problem. The LiteLLM compromise in March 2026, involving versions 1.82.7 and 1.82.8, belongs in the supply-chain category because the supplied research describes a compromised open-source Python package with more than 3 million daily downloads and possible impact across “tens of thousands” of corporate environments. The May 2026 TanStack or “Mini Shai-Hulud” compromise, which affected OpenAI through credential material exfiltrated from internal source code repositories of two employees, also fits the supply-chain and identity categories.
The table is not a scoring answer key. It is a structure for disciplined reading. Students should see that the same incident can sit in more than one category. A compromised package may become an identity problem if it exposes tokens. A phishing intrusion may become a supply-chain problem if a developer account gives access to source repositories or package publishing systems.
Classroom Activity And Assessment
Risk Matrix Exercise
Give each student team one short evidence card drawn from the research notes. One team might receive the SANS AI Survey result published in July 2026, which reported that 78% of organizations had confirmed or suspected AI-enabled attacks in the past year and that 95% believed threat actors were already using AI offensively. Another team might receive Comcast Business data covering March 1, 2025 through February 28, 2026, which logged 79.3 billion cybersecurity events, including 25.4 billion phishing events and 21.9 billion drive-by compromises. A third team might receive the TanStack-related compromise affecting OpenAI employee repository material.
Ask each team to produce a four-part risk statement: the affected system, the threat signal, the likely business or public-service impact, and one evidence-based control category. The control category should be general enough for safe classroom discussion. Acceptable examples include identity governance, dependency review, incident response planning, access logging, and user reporting channels. Do not ask students to describe exploit chains, malware behavior, credential theft procedures, or evasion techniques.
Teacher Notes For Safe Discussion
A cautious teacher stance matters because several research items involve high-impact systems and named organizations. Students may be tempted to rank vendors or models as safe or unsafe based on a single statistic. Redirect them to method, scope, and limits. The TELUS Digital results, for example, came from tests of 34 models across 10 providers. That is useful evidence for discussing model exposure, but it does not describe every configuration, customer deployment, guardrail setting, or monitoring practice.
The IBM breach-cost figures also need careful treatment. The supplied research says the report covered breaches between March 2025 and February 2026 and found higher average costs for AI-enabled malicious breaches. A student can responsibly say that the reported average was higher in that dataset. A student should not claim that every AI-enabled incident costs $6 million. This distinction is central to teaching AI infrastructure risks without exaggeration.
Assessment can be brief. Require each team to submit one paragraph and one evidence label. The paragraph should name the risk domain, quote or paraphrase the relevant statistic or incident date, state who could be affected, and identify one defensive control category. Grade the work on evidence use, technical clarity, and restraint. Penalize unsupported certainty, invented numbers, or offensive procedural detail.
Assessing AI Infrastructure Risks In Class
Evidence-Based Exit Prompt
End with an exit prompt that asks students to compare two risks from the lesson. A strong answer might compare identity weakness with supply-chain compromise. It would cite the Unit 42 finding from the supplied research that nearly 90% of investigations involved identity weaknesses, then contrast that with the March 2026 LiteLLM package compromise. The student should explain that identity controls and dependency controls are different, even though one incident can involve both.
This lesson works best when students learn that cyber risk is not a single score or a headline. It is a claim that needs evidence, scope, and limits. The most useful student product is a defensible risk statement: what happened, what system area was exposed, what data supports the concern, who may be affected, and what safe defensive action should be considered next.
