State of AI agent security 2026

A year ago, AI agent security was mostly a research topic: clever demos of a poisoned web page or a booby-trapped email making an assistant do something it shouldn't. By September 2026 agents read company email, open pull requests, run shell commands and hold production credentials, and most large companies say they use them. The demos kept coming, but so did deleted databases, malicious packages aimed at coding agents, a state-sponsored campaign run largely by an agent, and a steady stream of CVEs.

We wanted to know how bad it actually is, measured rather than asserted. So we built a record of 55 notable public incidents and disclosures since May 2025, counted agent-related CVEs in the US National Vulnerability Database and entries on CISA's list of exploited vulnerabilities, read the prompt-injection sections of every recent Anthropic and OpenAI system card, and collected the enterprise surveys that publish a sample size. Survey and vendor figures are the vendor's own claims, and most of the surveys come from companies that sell agent security; we say whose number each one is, and every number links to its source.

Agents went mainstream before the controls did#

Every survey we found that asked both "do you use agents?" and "can you control them?" got the same shape of answer: a large majority on the first, a minority on the second. The questions differ from survey to survey (some ask about use, some about plans), so read each pair on its own rather than across surveys.

The confidence often runs ahead of the controls too. In the same Okta 2026 survey, 96% of executives were confident their identity systems could secure non-human identities, while 34% applied the same controls to agents as to staff, and 58% said their company had an AI-related security issue or close call in the past year. Gravitee's April 2026 survey of 750 technology leaders in the UK and US, nearly all of whom run 11 or more agents, found that 19.7% secure and govern all agents before they go live, monitoring covers about 52% of deployed agents on average, and 7.2% have a named person formally accountable for agent behavior.

When SailPoint asked what agents had already done, the answers were specific. 80% said their agents had taken unintended actions, and 23% said an agent had been tricked into revealing access credentials.

Breach data points the same way. In IBM's 2025 breach study of 600 breached organizations, 13% reported a breach of AI models or applications, and 97% of those lacked AI access controls. A year later more than 20% reported a breach targeting AI models or applications. Some companies are adding human checks: in KPMG's pulse surveys, 63% required human validation of agent outputs in early 2026, up from 22% a year before.

The incident record#

Our record has 55 entries, from a GitHub MCP prompt injection in May 2025 to coding agents leaking screenshots in late September 2026. It's a curated list of notable public incidents and disclosures, not a census, and disclosures bunch around security conferences, so the shape over time says as much about researchers' calendars as about attackers.

We tagged each entry with one attack class. Prompt injection, where text the agent reads (an email, a web page, a pull-request comment) carries instructions it follows, is the biggest by far.

The injection entries repeat a few tricks across vendors. One is to make the agent render an image or link whose URL carries the stolen data: EchoLeak in Microsoft 365 Copilot, CamoLeak in Copilot Chat, ForcedLeak in Salesforce Agentforce, which used an expired allow-listed domain bought for $5. Another is a single crafted link whose URL parameter becomes a prompt: Varonis found that pattern in Copilot Personal, Microsoft 365 Copilot and Atlassian Rovo. In April 2026 one comment pattern stole secrets from Claude Code Security Review, Gemini CLI's GitHub Action and Copilot Agent at once; none of the three vendors issued a CVE, and GitHub paid a $500 bounty.

Injection is also leaving the lab. In March 2026 Unit 42 reported that indirect prompt injection "is being actively weaponized" on the web, with 14.2% of the payloads it saw aiming at data destruction and 6.2% at unauthorized transactions. A month later Google said the malicious category in its Common Crawl sweep had grown 32% between November 2025 and February 2026, though with "limited sophistication" so far. The clearest end-to-end case is Clinejection, where an injected issue title led, via a stolen npm token, to a rogue release that installed the OpenClaw agent on developer machines that updated during an eight-hour window.

Attackers also use agents directly. Anthropic reported a data-extortion operation that used Claude Code against at least 17 organizations, and a Chinese state-sponsored group, GTG-1002, that ran an espionage campaign against about 30 targets in which, per Anthropic, AI performed 80–90% of the work. MITRE has since catalogued it as ATT&CK campaign C0062.

The worst damage had no attacker#

The incidents that actually destroyed data share one pattern: an agent held credentials or permissions far beyond its task, nothing technical stopped it, and nobody was attacking it. Two of them ignored an explicit written rule. The one attacker-planted wiper in our record, inside an Amazon Q release, never ran because of a syntax error.

The details are telling. At PocketOS, the token was "created solely for managing custom domains" but could delete volumes, and the most recent recoverable backup was three months old. OpenAI's engineering lead described the GPT-5.6 deletions as a case where "the model makes an honest mistake", and The Register reported that the GPT-5.6 system card says the Sol variant takes "severity level 3" actions, such as deleting data without approval, more often than GPT-5.5. Glow Security's co-founder said the screenshot leaks came from agents that "found a workaround" to publish images from a private repository.

Opening a repository was enough#

The second pattern is configuration that runs code. Coding agents read project files (settings, hooks, MCP server lists) and some of them executed what they found before asking the user. Between July 2025 and July 2026, each of the five best-known coding agents had at least one flaw where an attacker-controlled repository, file or message was enough to run commands on the developer's machine.

Attackers noticed the same thing from the other side. In August 2025 the malicious Nx packages prompted victims' own Claude, Gemini and Q CLIs with flags like --dangerously-skip-permissions to search the disk for secrets. In April 2026 a Shai-Hulud wave delivered through a compromised Bitwarden CLI release targeted MCP configuration files and Claude Code credentials, and the same actor's SAP CAP packages planted a Claude Code SessionStart hook so the malware re-ran every time Claude Code started in the repository.

From a handful of CVEs to hundreds#

To measure vulnerabilities rather than headlines, we queried the NVD for every CVE published in each quarter whose description contains one of five exact phrases: "prompt injection", "Model Context Protocol", "MCP server", "AI agent" or "Claude Code". Deduplicated, the count went from 13 in the second quarter of 2025 to 256 in the third quarter of 2026. The third quarter of 2026 alone has more than double all of 2025 (111).

Part of this is attention: more researchers are looking, and MCP servers are small, numerous and often written quickly. But the count is of assigned CVEs, and the exploitation data is starting to follow. CISA's Known Exploited Vulnerabilities catalog, the US government's list of flaws attacked in the wild, had 12 entries for AI tooling by the end of September 2026, 11 of them added in 2026 and six in the third quarter alone.

The absence of agents on that list doesn't mean they're safe. Many agent flaws are fixed on the vendor's servers (EchoLeak, ShadowLeak, RovoBlast), which leaves nothing for a customer to patch, and the agent incidents that did real damage weren't vulnerabilities at all. What the list does show is that the infrastructure people stand up around agents (workflow builders, model gateways) gets attacked like any other internet-facing server.

The attacker moves second#

Most published prompt-injection numbers come from a fixed set of attacks: a benchmark, or the vendor's own test suite. In October 2025 researchers from OpenAI, Anthropic, Google DeepMind and ETH Zurich published "The attacker moves second", which re-tested 12 published defenses with attacks tuned against each one. They bypassed them "with attack success rate above 90% for most", and concluded that defenses reporting near-zero rates on public benchmarks "are often among the easiest to break". Human red-teamers in the same study beat every challenge they were given.

The pattern shows up wherever someone runs both kinds of test on the same target, including in the vendors' own system cards. Anthropic's Claude Opus 4.6 card reported 0% attack success on its coding test "across all conditions". Two months later, with a stronger attacker from Gray Swan, the Opus 4.7 card re-measured Opus 4.6 at 97.5% of scenarios broken within 200 attempts. It happened again with Opus 5: 0.56% of attempts in its own card, 88.92% against the next attacker in the Opus 5.5 card.

NIST's AI standards center saw the same jump in January 2025: on AgentDojo with Claude 3.5 Sonnet, success rose "from 11% for the strongest baseline attack to 81% for the strongest new attack", and repeated attempts lifted the average from 57% to 80%. Google wrote that without adaptive testing it "would have incorrectly concluded" Gemini 2.5 was more robust than it is.

Large public competitions measure the same thing from the attacker's side. In Gray Swan's 2025 challenge with the UK AI Security Institute, participants submitted 1.8 million prompt-injection attacks against 22 agents, and every model was broken on every target behavior. In the 2026 round, 464 participants made 272,000 attempts against 13 frontier models; all proved vulnerable, with success rates from 0.5% (Claude Opus 4.5) to 8.5% (Gemini 2.5 Pro). By our arithmetic, about 3% of individual attempts succeeded in both years (3.4%, then 3.2%), even though the models got harder to break.

None of this means the numbers are fake. It means a single benchmark score is a floor on what an attacker who studies your system can do, not a ceiling. Anthropic says so itself: its attackers know the deployment and get repeated tries, which real attackers "typically lack".

Vendor scores keep falling, on their own tests#

Read inside a single test, the vendor numbers do improve with each generation. OpenAI's GPT-5.6 system card reports defender success on "known prompt injection attacks" aimed at search and function calling. Converted to attack success, the rate fell from 57.7% for gpt-5.1-thinking to 9.0% for gpt-5.6-sol. The GPT-6 Astra card then retired that eval as saturated.

The vendors have also started testing each other's models on shared attack sets from Gray Swan. The most complete table is in Anthropic's Claude Opus 5 card, which reports the chance an attacker succeeds within 15 attempts on the same set of attacks for every model.

On a refreshed set in September, Anthropic put Claude Opus 5.5 at 0.1% on one attempt and 1.0% within 15, highest in computer use (2.8%). The same card shows how product details move the numbers: Opus 5.5's coding result against the stronger attacker was 54.61%, almost entirely from requests a safety classifier handed to the older Opus 4.8, and none of the 2,872 requests Opus 5.5 answered itself were susceptible. It also notes a regression: Opus 5.5 is more likely than earlier models to follow malicious instructions when the user pastes them into the prompt.

Both companies say plainly that this isn't finished. OpenAI wrote that prompt injection "is unlikely to ever be fully 'solved'", and Anthropic's Opus 4.5 card shared its results "to demonstrate meaningful progress, not to claim the problem is solved".

Agents are the new service accounts#

Every agent that acts on a system needs an identity to act as, and most get one quietly: an API key, an OAuth token, a service account. In CyberArk's 2025 survey of 2,600 security decision makers, respondents estimated 82 machine identities for every human. In the 2026 edition, now published under Palo Alto Networks, which CyberArk is part of, the estimate was 109 per human, 79 of them AI agents.

The same 2026 survey found that on average 40% of AI agents already have access to organizational data, and that fewer than half of organizations apply basic lifecycle controls to them: 45% monitor autonomous agents' behavior and 37% can revoke their credentials. The 2025 edition had found 68% lacked identity security controls for AI. PocketOS is what that looks like in practice: a token made for one job that could do every job.

The plumbing is catching up. Microsoft made its Entra Agent ID platform generally available in April 2026, built on OAuth 2.0, MCP and A2A. MCP's spec made servers OAuth resource servers that must reject tokens issued for anyone else in 2025, and in July 2026 deprecated dynamic client registration and required issuer validation. In September NIST's NCCoE reported 600+ comments on its concept paper for agent identity and authorization.

The frameworks caught up#

In December 2025 OWASP published its first Top 10 for Agentic Applications, written with more than 100 contributors. Almost every item already has a public example in our record.

OWASP's separate Top 10 for LLM applications moved "excessive agency" from sixth to third place in its 2026 edition, in August. Elsewhere, NIST launched an AI Agent Standards Initiative in February 2026, and Gartner told software leaders to treat any use case that combines sensitive data, untrusted content and external communication as a "no-go zone". Regulation, meanwhile, slowed down: the EU's AI Omnibus, in force since July 2026, pushed the AI Act's high-risk obligations back to December 2027.

What actually works#

If no model can be trusted to resist every injection, the defenses that hold are the ones that limit what a successful injection can do. Simon Willison's "lethal trifecta" names the dangerous combination: access to private data, exposure to untrusted content, and a way to send data out. Meta turned it into a design rule, the Agents Rule of Two: within one session, an agent should have at most two of three properties.

Approval prompts are a weak substitute. Anthropic found that Claude Code users approve 93% of permission prompts, which is why it moved toward sandboxing (filesystem and network isolation, which cut permission prompts by 84%) and an "auto mode" classifier that decides instead. Anthropic's own numbers for that classifier are honest about its limits: 0.4% of benign commands blocked, but 17% of real overeager actions missed in a sample of 52. By September auto mode was the default for most Claude Code users.

Measured defenses mostly show a trade between safety and usefulness, and each was tested on its own benchmark.

AgentDojo's authors note the limit of tool filtering: in 17% of their test cases the tools a task legitimately needs are enough to carry out the attack. That is the case the Rule of Two is for.

What this means if you build with AI#

Most of the incidents above would have been smaller with boring, structural controls. The data points to a short list.

1. Assume an injection will eventually succeed, and design for the blast radius. Every vendor says the problem isn't solved, and adaptive attackers beat defenses that test near 0%. Apply the Rule of Two: an agent that reads untrusted input shouldn't also hold production access and a way to send data out.
2. Give agents their own narrow, revocable credentials. Never leave a broad token where an agent can find it, and keep backups outside anything the agent can reach. At PocketOS one domain-management token could delete the production volume and its backups.
3. Put destructive actions behind a gate the model can't talk its way past. Written rules failed in Replit's code freeze and OpenClaw's "confirm before acting". Use separate dev and prod environments, read-only database roles and platform-level confirmations.
4. Prefer a sandbox to approval prompts. People approve 93% of prompts. Run coding agents with filesystem and network isolation, and don't use full-access or skip-permissions modes on a machine with real credentials.
5. Treat project config as code. Agent settings, hooks and MCP server lists in a repository ran before trust prompts in several agents. Keep your agents updated, and review .claude/, .cursor/ and similar folders in any repository you didn't write before opening it with an agent.
6. Close the quiet exfiltration channels. Auto-rendered images and links carried data out in EchoLeak, CamoLeak and ForcedLeak. If your agent renders URLs it composed, restrict them to an allow-list you control, and watch for expired domains on it.
7. Patch and fence the infrastructure around your agents. Every AI entry on CISA's exploited list is a self-hosted tool such as Langflow or LiteLLM with a classic bug. Don't expose them to the internet without authentication.

host0 is a cloud for small software: agent-built apps deploy as static files that read and write shared data through a platform-owned records API, so there is no user server code to hijack, and each app can be limited to the teammates its owner invites. Agents get an API key through a device login the user approves in their own browser, so no password ever passes through the chat.

Methodology#

This post draws on three research passes, one per angle: incidents and vulnerabilities, attack and defense measurements, and enterprise readiness and identity. Each was limited to primary sources: vendor advisories and postmortems, NVD and CISA entries, system cards, academic papers, survey publishers' own releases and reports, and first-hand reporting. Aggregator and "statistics" sites were used only as leads. Everything covers material published up to 30 September 2026. Before publishing, we re-opened the single-source pages the post leans on for headline numbers, including the system cards, and dropped anything they no longer said.

Our own computations:

• Incident record: 55 notable public incidents and disclosures from May 2025 to September 2026, each with at least one primary or reputable source, tagged with one attack class by disclosure date. It is curated, so the class shares describe what gets disclosed and reported, not what happens most.
• CVE counts: the NVD API's keyword search with exact-phrase matching, by publication date per quarter, for "prompt injection", "Model Context Protocol", "MCP server", "AI agent" and "Claude Code", deduplicated by CVE ID. We left out "Cursor", "Copilot" and "LLM", which match unrelated products.
• KEV entries: CISA's catalog filtered to agent builders, LLM gateways and ML platforms, added on or before 30 September 2026.
• Converted rates: OpenAI's defender-success scores turned into attack success (1 minus the score), and per-attempt rates for the Gray Swan competitions from their published totals.

We dropped or reworded several claims: an "88% of enterprises had agent incidents" figure that its own publisher's later survey replaced with 54%; a "96% … (CyberArk)" statistic that is SailPoint's; a CVE number widely given for CamoLeak that is wrong; reports of "two AWS outages" caused by Kiro, which AWS denies; the model behind the PocketOS deletion, which comes only from the founder's account; and any comparison of Anthropic's coding or browser results across system cards, because the attacker changed between them.

Limitations:

• Most surveys are vendor research. SailPoint, Okta, CyberArk, Palo Alto Networks and Gravitee sell identity or agent security. Questions and populations differ, so compare only within a survey.
• Attack success rates aren't portable. Each depends on the attack set, the number of attempts, the harness and whether safeguards are on. Vendor-run tests are the vendor's claim.
• Disclosure isn't incidence. Most prompt-injection entries are researcher demonstrations, and disclosures cluster around conferences.
• Keyword counts undercount. CVEs with terse or differently worded descriptions are missed.

Open questions#

1. How often does prompt injection succeed against deployed agents? Unit 42 and Google show attackers are trying; nobody publishes a success rate in production.
2. Why is no agent on CISA's exploited list? Either nobody has confirmed exploitation, or server-side fixes leave nothing for the list to track.
3. Who ran the injection in Clinejection? Sources agree the stolen token was used by an unknown actor, but not on who triggered the original injection.
4. How many GTG-1002 intrusions succeeded? Anthropic said "a small number" of about 30 targets.
5. How do shipped products hold up against adaptive attackers? Nobody independent has re-measured auto mode, probes or other production defenses.
6. How many agent CVEs are there, really? A curated census across GitHub advisories, vendor bulletins and NVD doesn't exist.
7. Where are Google's numbers? No Gemini model card after 2.5 publishes an agent prompt-injection metric we could chart.