F-Secure has published a new AI Harms Taxonomy that maps 26 ways artificial intelligence can harm consumers, from confidently misleading chatbot answers and synthetic impersonation to autonomous agents making damaging decisions. Rather than treating AI risk as a single model-security problem, the research traces how harm travels through systems and identifies points where developers, service providers and users can intervene.
The taxonomy organizes the 26 harms across five relationship types and 19 intermediary layers, with 24 proposed defenses attached to particular stages in the chain. Examples include AI-generated voice and video used for impersonation, personal information exposed by an AI system, agents acting on stale context and automated assistants making harmful financial decisions. F-Secure also examines malicious instructions hidden inside webpages, documents or other content that an AI system processes.
That last category reflects a security issue already documented by the National Institute of Standards and Technology, which describes agent hijacking as a form of indirect prompt injection. An attacker can place instructions in data an agent reads, potentially causing it to take unintended actions. The OWASP Top 10 for LLM Applications similarly lists prompt injection as a leading risk and warns that excessive agency can turn manipulated or unreliable model output into damaging activity through connected tools.
Unlike a conventional software flaw, F-Secure’s taxonomy does not identify a single affected product, CVE, CVSS score or patch that resolves the problem. The severity instead depends on the system’s design: what data the model can access, which tools it can invoke, how much autonomy it has and whether a person must approve consequential actions. A misleading answer may cause confusion, while an agent with access to email, payment systems or accounts can convert the same underlying manipulation into a real-world loss.
F-Secure’s work is presented as a developing research resource rather than a closed vulnerability catalog; the company says some entries have a thinner evidence base and that the structure will evolve with the technology. For defenders, the practical implication is to assess the entire AI workflow, not only the model. Separating trusted instructions from untrusted content, minimizing permissions, validating model-generated outputs, logging tool use and requiring human approval for high-impact actions can provide the intervention points the taxonomy is designed to expose.
