)
A TSA airport cybersecurity warning refers to formal Security Directives and public advisories issued by the U.S. Transportation Security Administration to protect aviation infrastructure from cyber threats, including, since 2025, AI-specific attack vectors such as prompt injection, biometric data manipulation, and supply-chain ransomware targeting airport AI systems.
The September 2025 ransomware attack on Collins Aerospace, which grounded check-in systems at Heathrow, Brussels, Berlin, and Dublin, demonstrated that these warnings are no longer theoretical. AI systems at airports are now a primary target, and current TSA directives do not yet explicitly address generative AI vulnerabilities.
TL;DR - Key Takeaways
- In March 2025, the TSA issued public cybersecurity warnings to travelers covering juice jacking (USB port malware) and unsecured public Wi-Fi, the most recent official TSA consumer-facing cybersecurity advisories.
- In September 2025, a ransomware attack on Collins Aerospace's MUSE check-in platform disrupted Heathrow, Brussels, Berlin, and Dublin airports simultaneously, confirmed by ENISA as a supply-chain ransomware incident.
- Over 250 U.S. airports already use biometric facial recognition. TSA's own AI use cases include CT scanner threat detection and LLM-based training tools, making AI an operational reality, not a future concern.
- Generative AI introduces five attack vectors traditional TSA directives do not cover: prompt injection, data poisoning, impersonation, excessive agency, and unbounded consumption.
- NeuralTrust TrustGate, TrustTest, and TrustLens provide the runtime protection, adversarial testing, and continuous monitoring that airport AI deployments now require.
What is a TSA airport cybersecurity warning?
Every frequent flyer knows the familiar rhythm of the airport security line: the practiced removal of laptops and liquids, the scan of a boarding pass, and the quiet hope for a swift journey through the checkpoint.
But beyond the physical screening that occupies travelers' attention, a less visible but equally potent threat is rapidly taking root. This threat cannot be detected by a body scanner or flagged by a canine unit. It is the complex and often opaque world of generative AI systems embedded throughout airport infrastructure.
When you hear about a TSA airport cybersecurity warning, it typically refers to one of two things: a public advisory directed at travelers, or a Security Directive, a binding legal mandate issued directly to critical infrastructure operators including airports and airlines.
Security Directives are not general notices. They are enforceable mandates with teeth. Driven by persistent cyber threats, a risk that gained national urgency after the Colonial Pipeline ransomware attack, they compel airport operators to take specific, performance-based actions:
- Develop robust network segmentation policies to isolate sensitive operational systems from general IT networks.
- Implement stringent access control measures to prevent unauthorized individuals from reaching critical systems.
- Establish continuous monitoring and detection to defend against and respond to cyber threats in real time.
- Create a risk-based plan for applying security patches to mitigate known vulnerabilities.
As of early 2026, TSA has signaled it intends to formalize aviation cybersecurity requirements through notice-and-comment rulemaking. The aviation rulemaking timeline proceeds separately from TSA's surface-transportation cybersecurity rulemaking. Covered operators should track the Federal Register for current status.
It is also important to distinguish these systemic, infrastructure-level concerns from being personally "flagged by TSA" as a traveler. Being flagged, often manifesting as the "SSSS" (Secondary Security Screening Selection) on a boarding pass, is a much more immediate and individual issue. But as airport systems become increasingly intelligent and interconnected, the line between a remote cybersecurity event and a personal travel disruption is disappearing.
What are the real TSA cybersecurity warnings issued in 2025?
In March 2025, the TSA issued two direct cybersecurity warnings to travelers, the most recent official public-facing advisories from the agency:
Warning 1: Juice jacking via USB charging ports
The TSA warned travelers not to plug phones directly into public USB ports at airports. "Hackers can install malware at USB ports (we've been told that's called 'juice/port jacking')", the agency stated. Once a device is compromised, attackers can capture text messages, contact lists, and keystrokes. The TSA recommends using a personal power brick or battery pack instead. (Source: Fox News, June 2025; TSA Facebook, March 2025)
Warning 2: Unsecured public Wi-Fi
"Don't use free public Wi-Fi, especially if you're planning to make any online purchases. Do not ever enter any sensitive info while using unsecure Wi-Fi," the TSA warned. Attackers can intercept unencrypted data on open networks, harvesting credentials and personal information from distracted travelers.
And in June 2025, the FBI separately issued a warning about cybercriminal groups with sophisticated methods of bypassing airport cybersecurity systems to access passenger data, crew information, and internal scheduling details. (Source: Daily Passport, August 2025)
These warnings target individual travelers. But as the September 2025 European airport attack demonstrated, the far larger threat is at the infrastructure level, and AI is now at the center of it.
What AI systems are already deployed in airport security?
Artificial intelligence is no longer a futuristic concept in airports, it is an operational reality. According to the DHS TSA AI Use Case Inventory (January 2026 update), the TSA actively operates AI across multiple functions including on-person screening algorithms, CT scanner threat detection, and an LLM-based employee training platform. From the moment you arrive at the airport, you are interacting with a web of AI-powered systems:
- Facial Recognition and Biometric Verification: Over 250 U.S. airports now use biometric facial comparison technology at check-in, bag drop, security, and boarding. TSA's Credential Authentication Technology 2 (CAT-2) units combine ID document scanning with live facial comparison. According to TSA, participation in biometric features is voluntary and passengers may opt out.
- AI-Enhanced CT Screening: TSA is deploying Computed Tomography (CT) scanners with AI algorithms trained to automatically identify prohibited items in carry-on bags, reducing the need to remove electronics and liquids. TSA's Low-PFA (Low Probability of False Alarm) algorithms improve detection performance while decreasing passenger alarm rates — the algorithm is gender-agnostic and does not require officers to select a passenger's gender prior to scanning.
- Intelligent Surveillance: Airports use AI-powered video analytics to monitor secure areas, detect unauthorized tailgating through secure doors, and analyze crowd behavior in real time.
- Generative AI Chatbots: Airports and airlines deploy AI-powered chatbots to handle passenger inquiries, provide real-time flight updates, and manage customer service at scale.
These systems are often supplied as "black boxes" from third-party vendors, leaving airport IT teams with limited visibility into their inner workings. This creates high-value targets for attackers seeking to exfiltrate sensitive data, manipulate critical instructions, or impersonate authorized personnel.
How the September 2025 European airport attack changed everything
On September 20, 2025, a ransomware attack on Collins Aerospace, a defense contractor and subsidiary of RTX (formerly Raytheon) crippled the MUSE (Multi-User System Environment) platform used for airline check-in and boarding at major European airports. The impact was immediate and physical:
- London Heathrow, the continent's busiest airport, was forced to revert to manual ticketing with thousands of passengers in manual check-in queues.
- Brussels Airport ultimately cancelled approximately 140 flights. It used iPads and laptops to check passengers in while systems remained down for days.
- Berlin Brandenburg Airport issued handwritten boarding passes to passengers.
- Dublin and Cork airports in Ireland reported "minor impact."
ENISA officially confirmed that a ransomware attack on Collins Aerospace caused the airport IT outage, with law enforcement brought in to investigate. A man was arrested in West Sussex, England by the UK's National Crime Agency on suspicion of Computer Misuse Act offences. Collins Aerospace is a defence contractor with ties to NATO, leading to speculation that the threat actors may be Russian state-sponsored hackers engaging in hybrid warfare. The identity of the responsible group was not officially confirmed.
"The aviation industry has become an increasingly attractive target for cybercriminals because of its heavy reliance on shared digital systems," Charlotte Wilson, head of enterprise at cybersecurity firm Check Point, told Euronews. "These attacks often strike through the supply chain, exploiting third-party platforms that are used by multiple airlines and airports at once. When one vendor is compromised, the ripple effect can be immediate and far-reaching, causing widespread disruption across borders."
This was not an AI attack in the generative sense, it was ransomware against a critical supplier. But it illustrated exactly why AI security in airports cannot be treated separately from broader critical infrastructure security. A single compromised vendor brought down four major airports simultaneously. When the vendor's systems include AI components, as Collins Aerospace's MUSE platform increasingly does, the blast radius of a successful attack expands further.
This is how a cybersecurity event becomes a physical crisis. A remote compromise of a check-in system stops you from boarding your flight. A compromise of a biometric system denies your identity. A compromise of an AI-powered scheduling system cascades across an entire hub's operations. The September 2025 attack made this concrete at continental scale.
How does generative AI create new threat vectors in the aviation industry?
The widespread adoption of generative AI, particularly large language models (LLMs), introduces a new and alarming set of vulnerabilities into the airport ecosystem that ransomware defenses alone cannot address. Because these models interpret and generate human-like text, they are susceptible to attacks that have no equivalent in traditional IT security:
-
Prompt Injection and Jailbreaking: A malicious actor crafts specific inputs to manipulate a passenger-facing chatbot, bypassing its safety controls. This could extract sensitive information, generate false gate instructions, or execute unauthorized commands in connected systems. Ranked #1 in the OWASP Top 10 for LLM Applications (LLM01:2025).
-
Data Poisoning and Inference: If an attacker introduces malicious data into a model's training set or a connected RAG system, they corrupt the model's responses. LLMs can also inadvertently leak sensitive information through clever questioning, a particular risk in systems trained on passenger records or security protocols.
-
Impersonation and Misinformation: An attacker exploits an AI system to convincingly impersonate an airline employee or TSA agent, directing passengers to wrong gates, providing false emergency information, or creating operational chaos.
-
Excessive Agency: When an AI chatbot has permission not just to inform but also to modify bookings or access gate management software, a single successful injection can trigger real operational changes, like rebooking passengers without consent or changing gate assignments system-wide.
-
Unbounded Consumption: Attackers craft recursive prompts that consume enormous computational resources, overwhelming the AI system and creating denial-of-service conditions for legitimate users while incurring significant cloud costs for the airport operator.
None of the above attack vectors are addressed by the network segmentation and access control requirements in current TSA Security Directives. These are entirely new categories of risk.
Why must TSA cybersecurity warnings explicitly address AI?
Given the rapid integration of AI and the novel threats it presents, TSA Security Directives must evolve. Current mandates focus on traditional IT and OT security principles. While essential, they are insufficient to address the unique vulnerabilities of generative AI in aviation.
Future TSA advisories and directives must explicitly require:
- LLM Misuse and Manipulation Controls: Mandatory runtime inspection for prompt injection, jailbreaking, and impersonation in all public-facing and internal AI applications at airports.
- Shadow AI Governance: Policies addressing the risk of airport staff or vendors using unsanctioned and unsecured generative AI tools for operational tasks.
- Runtime Monitoring Requirements: Real-time visibility into how AI models are being used and queried, with anomaly detection and audit trail requirements for all AI interactions.
- AI-Specific Access Control: Ensuring AI systems do not have excessive permissions to sensitive data or connected operational systems — the "excessive agency" problem the OWASP Top 10 explicitly identifies.
- Supply Chain AI Risk Assessment: Given the Collins Aerospace incident, mandatory security assessment of AI components in all third-party systems used by airports.
The aviation industry must move toward a new security paradigm that includes:
- Comprehensive red teaming of all airport AI applications before deployment.
- Real-time gateway protection that inspects every AI interaction for adversarial behavior, blocking prompt injection and data leakage in the request flow via TrustGate.
- Continuous logging and anomaly detection for monitoring generative AI behavior at scale, enabling security teams to trace every interaction in real time.
- Strict data encryption and runtime data masking to protect user inputs and AI outputs from exposure.
How does NeuralTrust secure public infrastructure AI?
NeuralTrust provides a comprehensive, infrastructure-level security stack designed to address AI vulnerabilities at the runtime, testing, and governance layers.
Agent Gateway (TrustGate)
TrustGate acts as a critical runtime defense layer. It inspects every prompt and response in real time — under 100ms — blocking malicious activity including jailbreaks, impersonation attempts, code injection, and sensitive data leakage before they can cause harm. For airport AI deployments handling millions of passenger interactions, this gateway layer is the operational equivalent of a security checkpoint for AI traffic.
AI Red Teaming (TrustTest)
TrustTest allows organizations to proactively discover and remediate vulnerabilities before deployment. It simulates thousands of real-world adversarial attacks — including RAG poisoning, prompt chaining, and obfuscation techniques — to ensure AI applications are resilient from day one. In a critical infrastructure context, this pre-deployment testing is the equivalent of a security audit before a system goes live.
Agent Posture Management (TrustLens)
TrustLens provides the monitoring, observability, and traceability that is essential for secure AI operations. It logs every AI interaction, triggers intelligent alerts based on anomalous behavior, and ensures a complete audit trail for compliance and incident response — directly supporting the logging and monitoring requirements that future TSA AI directives will mandate.
)
FAQs about TSA airport cybersecurity warnings
1. What is the TSA airport cybersecurity warning?
The TSA issues two types of cybersecurity warnings: public advisories directed at travelers (such as the March 2025 warnings about juice jacking and unsecured Wi-Fi), and Security Directives — binding legal mandates issued to airport and airline operators requiring specific cybersecurity controls. Security Directives compel operators to implement network segmentation, access controls, continuous monitoring, and incident response planning for critical aviation infrastructure.
2. Does TSA monitor airport cybersecurity?
Yes. The TSA has regulatory authority over aviation cybersecurity and issues enforceable Security Directives to airport and airline operators. As of early 2026, TSA has signaled it intends to formalize these requirements through notice-and-comment rulemaking, moving from emergency directives toward permanent regulation. The TSA also maintains its own AI systems — including CT scanner threat detection algorithms and LLM-based training tools — as documented in the DHS TSA AI Use Case Inventory.
3. What are the AI threats at airports in 2026?
The primary AI-specific threats at airports include prompt injection attacks against passenger-facing chatbots and AI assistants, data poisoning of AI training datasets or RAG knowledge bases, impersonation of airport staff through AI-generated communications, excessive agency attacks exploiting AI systems with overly broad permissions to operational systems, and supply-chain ransomware targeting third-party AI software providers — as demonstrated by the September 2025 Collins Aerospace attack on Heathrow, Brussels, Berlin, and Dublin.
4. How does TSA use AI for airport security?
According to the DHS TSA AI Use Case Inventory (January 2026), the TSA operates AI across several functions: Low-PFA (Low Probability of False Alarm) algorithms in millimeter-wave body scanners for on-person screening; AI-powered CT scanner image analysis to automatically identify prohibited items in carry-on bags; and an LLM-based interactive training platform for employee development. The TSA also uses Credential Authentication Technology (CAT-2) units that combine document scanning with live facial comparison for identity verification.
5. Was the September 2025 European airport cyberattack caused by AI?
No — the September 2025 attack on Collins Aerospace was a ransomware attack targeting the MUSE check-in and boarding platform, confirmed by ENISA. However, the incident is directly relevant to AI security in airports because it demonstrated how a single compromised third-party software supplier can simultaneously disrupt multiple major airports, and because aviation AI systems increasingly depend on the same category of third-party vendor infrastructure that was attacked. Future AI-specific attacks will exploit generative AI vulnerabilities that ransomware defenses alone cannot address.
Key Takeaways - What did we learn through this article?
- The TSA's cybersecurity mandate covers both public-facing warnings to travelers (juice jacking, unsecured Wi-Fi) and enforceable Security Directives to airport operators — but neither currently addresses generative AI vulnerabilities explicitly.
- The September 2025 ransomware attack on Collins Aerospace confirmed that airport supply-chain vulnerabilities are actively exploited at scale, disrupting Heathrow, Brussels, Berlin, and Dublin simultaneously.
- Generative AI introduces five attack categories — prompt injection, data poisoning, impersonation, excessive agency, and unbounded consumption — that are unaddressed by current TSA Security Directives.
- Over 250 U.S. airports already operate biometric AI systems, and TSA itself runs AI use cases for screening and training — making AI-specific security not a future concern but a present operational requirement.
- NeuralTrust TrustGate, TrustTest, and TrustLens provide the three layers — runtime protection, pre-deployment adversarial testing, and continuous monitoring — that airport AI deployments now require.
Related Articles
- Generative AI Security for Airlines — How airlines are deploying generative AI and the specific security controls required to protect passenger-facing AI applications.
- How Prompt Injection Works — A technical deep-dive into the #1 OWASP LLM risk and how to defend against it in production AI systems.
- Advanced Techniques in AI Red Teaming — How to proactively stress-test AI systems before deployment using automated adversarial attack simulation.
- Mastering AI Traffic with LLMOps — How to build continuous monitoring for generative AI behavior at scale.
- The Complete Guide to AI Governance: Frameworks, Policies & Best Practices (2026) — The enterprise-wide AI governance framework that airport operators need alongside technical security controls.
About the Author
Rodrigo Fernández is an AI Security Researcher at NeuralTrust, where he focuses on AI vulnerabilities in critical infrastructure, agentic AI attack surfaces, and LLM security for enterprise deployments. Connect on LinkedIn
NeuralTrust is an AI agent security platform, recognized in the Gartner 2025 Market Guide for AI Gateways and the KuppingerCole 2025 Leadership Compass for Generative AI Defense. Headquartered in Barcelona with ISO 27001 certification.
)
)
)