The Information Security Threat Database of the FSTEC of Russia (the Federal Service for Technical and Export Control; the database is known by its Russian abbreviation BDU) has a separate subsection, “Information security threats to artificial intelligence systems” (bdu.fstec.ru/threat/ai). It divides the threats into two groups, in the developer’s infrastructure and in the operator’s infrastructure, and lists the ways they are carried out: from poisoning training data to special requests through RAG and changes to an agent’s system prompt. The earlier separate threats UBI.218–222 are marked as no longer relevant because the subsection has appeared.
The names of the subsection, threats and documents below are our translation; the database is in Russian.
In brief
- Where: the BDU subsection “Information security threats to artificial intelligence systems”, bdu.fstec.ru/threat/ai.
- Two groups: the developer’s infrastructure (3 threats, 6 ways of carrying them out) and the operator’s infrastructure (4 threats, 7 ways).
- Agents are named explicitly: among the operator’s objects of assessment are AI agents, API interfaces and censorship systems (filters of input and output data).
- What is missing: the subsection does not consider threats related to the quality of models, so an agent’s mistake with no intruder involved is not described in it.
- How to apply it: assess threats under the FSTEC of Russia Methodology for Assessing Information Security Threats of 5 February 2021; for Order No. 117, negative consequences are determined on the basis of the BDU.
What is the FSTEC BDU?
The Information Security Threat Database is an open register of threats and vulnerabilities maintained by the State Research and Testing Institute for Technical Information Protection Problems of the FSTEC of Russia. As of 14 October 2026 it contains 227 threats and 97,562 vulnerabilities. Operators of state information systems rely on it when they model threats: under point 11 of the Requirements approved by FSTEC Order No. 117 (page in Russian), the operator determines negative consequences on the basis of information from the threat database.
Which AI threats are in the BDU?
The subsection covers threats to the confidentiality, integrity and availability of information in an AI system that are created by external and internal intruders. Threats to the computers, servers, networks and system software themselves are assessed under the general database; the subsection contains only those specific to AI.
The developer’s infrastructure (developing and training the model). Objects: the developer’s software with frameworks and libraries; the environment for developing API interfaces, agents and censorship systems; the input model; training data sets; the output model and its weights. Threats:
- leakage of confidential information from the developer’s infrastructure, for example from the training data or about the training parameters;
- unauthorized copying (theft) of the model;
- disruption of the functioning (distortion of the behaviour) of the model being trained.
| Way | How it is carried out at the developer |
|---|---|
| SP.1 | Vulnerabilities and undeclared capabilities of the developer’s software, frameworks, libraries |
| SP.2 | Vulnerabilities and undeclared capabilities of the input model |
| SP.3 | Flaws in the training data sets |
| SP.4 | Unauthorized modification of the software or the configuration of the development environment |
| SP.5 | Unauthorized modification (poisoning) of the training data |
| SP.6 | Unauthorized modification of the model’s weights, LoRA and RAG data |
The operator’s infrastructure (operation). Objects: the operator’s software, AI agents, API interfaces, censorship systems; auxiliary software, including protection and automation tools; the trained model and its extensions (LoRA, RAG). Threats:
- leakage of confidential information from the AI system: the model, RAG, LoRA, the system prompt, the agent;
- unauthorized copying (theft) of the model;
- disruption of the functioning of the AI system;
- denial of service of the AI system.
| Way | How it is carried out at the operator |
|---|---|
| SP.1 | A large number of requests to the interfaces: denial of service |
| SP.2 | Special requests, including through RAG or external sources that supplement requests: obtaining confidential information or disrupting operation |
| SP.3 | Requests that reveal the model’s flaws: an adversarial attack |
| SP.4 | Changing the model’s weights |
| SP.5 | Changing the configuration of the model and agents, for example the system prompt |
| SP.6 | Mass requests to train another model: theft of the model |
| SP.7 | Exhausting a user’s request (token) quota: denial of service |
If the operator fine-tunes the model itself, trains it continuously, or creates LoRA or RAG data, it must also take the threats to the developer’s infrastructure into account.
What became of the threats UBI.218–222?
Before the subsection appeared, AI threats were separate entries in the general list. Now the card of each of them states that the information about the threat is no longer relevant because the subsection “Information security threats to artificial intelligence systems” has been published; in the BDU change feed these cards are marked with the date 19 December 2025.
| Number | Name |
|---|---|
| UBI.218 | Threat of disclosure of information about a machine learning model |
| UBI.219 | Threat of theft of training data |
| UBI.220 | Threat of disruption of the functioning (“bypass”) of tools that implement artificial intelligence technologies |
| UBI.221 | Threat of modification of a machine learning model by distortion (“poisoning”) of training data |
| UBI.222 | Threat of substitution of a machine learning model |
A threat model that describes AI only with these five numbers should be revised against the subsection.
What in the subsection concerns AI agents?
- Agents are an object of assessment. At the operator, AI agents are listed next to the model and the API interfaces; at the developer, the environment for developing agents.
- Leakage through an agent: the system prompt and the agent itself are among the sources of confidential information.
- Special requests through RAG and external sources (SP.2) are in essence prompt injection, direct and indirect.
- Changing an agent’s configuration (SP.5), for example substituting the system prompt.
- Censorship systems, filters of input and output data, that is guardrails, are an object of assessment too, not only a means of protection.
What is missing from the subsection: threats related to the quality of models. An agent that deleted data or made a wrong payment with no intruder involved is not a threat in the sense of the subsection. Such actions are covered not by the threat model but by rules for the agent and a check of every action before it runs; see IS 3.0.
How do you take AI threats into account in a threat model?
The subsection requires the developer and the operator to assess threats and the applicable ways of carrying them out, taking into account:
- the infrastructure where the AI system runs: its own, at a service provider, or through an API;
- the level of significance of the information processed: restricted information, personal data;
- the functionality of the system: the model itself, agents, additional training;
- the division of responsibility between the developer, the operator and the provider of computing services.
The assessment is made under the Methodology for Assessing Information Security Threats approved by the FSTEC of Russia on 5 February 2021 and serves to choose protection measures. For state systems, these measures are then checked against points 60–61 of Order No. 117 and against the draft amendments on AI agents.
What to do
- Open the subsection bdu.fstec.ru/threat/ai and check your current threat model against it.
- Replace references to UBI.218–222 with the threats and ways of the subsection.
- Determine what you are for the AI system: the developer, the operator or both (if you fine-tune the model or maintain RAG).
- Include agents in the list of objects: their configurations, system prompts, tools and rights.
- Separately describe the inadmissible actions of agents that the subsection does not cover, such as deletion, payments and data export, and the rules under which they are checked.
Frequently asked questions
Does the FSTEC BDU contain threats for artificial intelligence?
Yes. The BDU has a subsection, “Information security threats to artificial intelligence systems” (bdu.fstec.ru/threat/ai). It describes three threats in the developer’s infrastructure and four in the operator’s infrastructure, with 6 and 7 ways of carrying them out respectively.
Which UBI numbers relate to AI?
Previously, UBI.218–222: disclosure of information about a model, theft of training data, “bypass” of AI tools, poisoning of training data and substitution of a model. Now their cards state that the information is no longer relevant because the subsection on threats to AI systems has been published.
Does the FSTEC BDU take AI agents into account?
Yes. AI agents are named among the objects of assessment in the operator’s infrastructure, the system prompt and the agent are among the sources of leakage, and changing an agent’s configuration is among the ways of carrying out threats (SP.5).
How are AI threats modelled under the FSTEC methodology?
Under the FSTEC of Russia Methodology for Assessing Information Security Threats of 5 February 2021, taking into account the subsection on AI threats: determine the infrastructure, the significance of the information, the functionality of the system (model, agents, fine-tuning) and the division of responsibility between the developer, the operator and the provider.
Does the BDU cover the mistakes of an AI agent?
No. The subsection expressly excludes threats related to the quality of models and considers the actions of intruders. Wrong actions of an agent with no intruder involved must be covered by rules and by checking actions before they run.
Sources
- FSTEC of Russia, Information Security Threat Database, subsection “Information security threats to artificial intelligence systems” (in Russian): https://bdu.fstec.ru/threat/ai
- Threat cards UBI.218–222 (in Russian): https://bdu.fstec.ru/threat/ubi.218 … https://bdu.fstec.ru/threat/ubi.222
- FSTEC of Russia Order No. 117 of 11 April 2025 (as amended on 8 May 2026), point 11 (in Russian): http://publication.pravo.gov.ru/document/0001202506170011
Checked: 16 October 2026