Ajax is an excellent piece of technology to improve user experience, and make online applications behave like desktop ones.
Ajax basically bridges the gap beetween client side and server side - it uses javascript (a client side language) to communicate directly with the server in real time, without having to reload the page, and send a direct request to the server.
What does it mean in terms of threat?It means that a hacker can use client side attacks to get control of the server, hence the whole network linked to it.
The threat is real, and has already been experienced by high profile websites such as myspace which had to shut down the site to address the issue in 2005.
So, before releasing new Ajax features, developers need to be made aware of the threats specific to this technology. Javascript has got a lot of security holes, which were not too much an issue as long as the language was only use on the client side - but with Ajax, it now provide the ideal gateway for new worms or other types of attacks targetting the server.
The hackers will probably concentrate their efforts on online managed security application - they usually like to take the piss..
On the other side, online applications venders will argue that it is easier to address security issues, since they just have to release fixes on the centralised server. desktops application on the other end need to get updates downloaded directly to their computer. But I don't think they really have a point here - if you use Norton anti Virus for instance, you already get updates automatically from a centralised server, and delivery issues are not real issues.
We have started doing some Research & Development in order to integrate ajax to our
content management application - but since the use of a funky UI is not our selling point, we are definitely going to be very cautious and conservatives in terms of new developments in this area, and make sure that all new Ajax features we develop are bullet proof.