AI Agent Security 2026: Fleets Double While Half Run Unmonitored

Several reports, one name, one warning

In 2026, at least three security firms published reports called "The State of AI Agent Security." They used different methods and their numbers don't always match. They agree on the main point: companies are deploying autonomous AI agents faster than they can secure them. Prompt injection, an attack that slips hostile instructions into the text an agent reads, remains the hardest problem in the field.

The most widely cited series comes from Gravitee, a company that sells API and agent-management tools. Its April 2026 update surveyed 750 senior technology leaders in the UK and US. It found that the typical company's agent fleet had roughly doubled since December 2025, while the share of agents being monitored barely changed.1 The mean share of agents under active monitoring was about 52%, which means about 48% of production agents run without security or governance controls. Only 9.5% of organisations secure more than four-fifths of their agents.1

Gravitee's February edition surveyed more than 900 executives and practitioners. It reported that 80.9% of technical teams had moved past planning into testing or production, but only 14.4% said all their agents went live with full security and IT approval.3 NeuralTrust ran a separate survey of more than 160 CISOs and reached a similar conclusion: AI adoption has moved faster than AI security.4 Inkog took a different approach. Instead of asking executives, it scanned more than 500 open-source agent repositories and found at least one vulnerability in 85% of them.5

The confidence gap is the real headline

The most telling finding in the Gravitee data isn't the incident rate. It's the gap between how secure leaders feel and how secure their agents actually are. Between December and April, the share of respondents confident in their visibility over agents rose from 82.6% to 91.8%. Over the same period, average monitoring coverage went from about 47% to about 52%, while the number of agents doubled.1 Formal, named accountability for agents rose from roughly 1% to just 7.2%.1 Gravitee sums this up by saying organisations are getting more comfortable with a risk they haven't reduced.1

NeuralTrust's CISO survey shows the same pattern. 73% of respondents said they were very or critically concerned about agent risk, but only 30% reported comprehensive AI-specific controls.6 A quarter of enterprises in that study had no AI-specific controls at all.4 The defenses most relevant to adversarial attacks were also the least common: prompt injection filtering at 27%, red teaming at 19%, and supply-chain integrity checks at 19%.4

The most likely reason is that leaders are judging their written policies, not what their agents actually do. Gravitee's February report says much of the confidence rests on high-level policy documents.7

Where the incident numbers diverge

The reports differ most on how often things actually go wrong. Gravitee's February report said 88% of organisations had a confirmed or suspected agent security or privacy incident in the previous year, rising to 92.7% in healthcare.3 Its April survey put the figure at 54%, with 34.9% confirmed. Telecoms (67.3%) and financial services (54.7%) had the highest rates.1 Gravitee itself suggests the drop in confirmed incidents, from 59.3% to 34.9%, probably reflects underreporting rather than real improvement.1 NeuralTrust's survey was much lower: 19.5% of CISOs reported at least one agent-related incident.6

Those figures range from about one in five to nearly nine in ten, so any single number should be treated with caution. A recent analysis made this point directly. It noted that Gravitee's 54% includes suspected incidents and not just confirmed breaches, and that the company sells products in this market. It also noted that Cisco's widely quoted gap, with 83% planning agentic AI but only 29% feeling ready, measures intentions, not attacks.14 Survey design accounts for much of the spread. Asking CIOs and platform leads about "experienced or suspected" incidents is likely to produce a higher number than asking CISOs about confirmed breaches.

One point holds across all of them: incidents are already happening. Where the surveys describe causes, the same issues come up repeatedly. In NeuralTrust's data, prompt injection (68%), sensitive-data leakage (61%) and unauthorized agent actions (52%) were the most common causes of incidents.4 Gravitee's analysis of open-text answers identified over-privileged access as the most consistent failure in both survey rounds. In April it also flagged deliberate adversarial exploitation as a new pattern.1

Prompt injection: a design flaw, not a bug

Academic and benchmark research is more reliable here than the surveys, and it is not encouraging. The StakeBench study ran 3,168 adversarial tests against web agents built on GPT-5 and Gemini. Direct prompt injection succeeded more than 79% of the time in every configuration. Indirect injection, where the instructions are hidden in ordinary web content like product reviews, succeeded between 41.67% and 68.16% of the time.15 No attack scenario was consistently blocked.15

The researchers also described a failure mode they call "stealthy parasitism." The agent completes the task the user asked for while also carrying out the attacker's goal, so the user may see nothing wrong.15 That undermines a common assumption behind human oversight: that a compromised agent will behave in visibly broken ways.

The OWASP GenAI Security Project now describes prompt injection as an architectural flaw rather than a bug that can be patched.18 A 2026 academic survey traces the cause to the fact that language models can't reliably tell instructions apart from data. It found that input filtering detects 60–80% of attacks and the best architectural defenses block up to 95% of known patterns, but significant gaps remain against new techniques.20 According to coverage of OWASP's 2026 report on agentic applications, prompt injection maps to six of its ten risk categories. That edition also lists real CVEs where the previous one listed hypothetical threats.1013

Newer attack research is getting more sophisticated. One line of work splits a malicious instruction into fragments buried in large amounts of filler text, reaching a 61.4% average success rate across seven models. Another studies self-replicating injections that spread from agent to agent like a worm.17 These are adversarial machine-learning techniques built to get past keyword filters, and they are not crude jailbreaks.

How much of this is happening in the wild

There is a real difference between what attacks are possible and what attackers are actually doing. Google researchers scanning web-archive snapshots found a 32% relative increase in malicious prompt-injection content between November 2025 and February 2026. They also said most of the injections they found were harmless or unsophisticated.14 Forcepoint confirmed ten injection payloads on live websites, including one that tells an agent to send a fixed $5,000 PayPal payment. Unit 42 has catalogued 22 techniques for building such payloads.14

Some widely shared statistics, such as claims of a several-hundred-percent jump in injection attacks, are hard to trace to a primary source and should be treated with skepticism. The documented record is smaller but more convincing. It includes a backdoored LiteLLM package that stayed on PyPI for about three hours and was downloaded nearly 47,000 times, reaching CrewAI, DSPy and Microsoft GraphRAG.10 It also includes CVE-2026-22708 against Cursor, which lets an attacker turn allowlisted commands like git branch into a way to deliver arbitrary payloads.13 Separately, SecurityScorecard flagged 35.4% of internet-exposed OpenClaw deployments as vulnerable.18

Coding agents are where most of the new attack data comes from. They make up 28 of the 53 agentic projects OWASP tracks, and they ship updates so quickly that some release more than once a day. That makes security triage very difficult.13

The fix is about identity and permissions, not better filters

Taken together, the most useful conclusion is that prompt injection is what gets an attacker in, but excessive privilege is what turns that into real damage. Gravitee's February data found that only 21.9% of teams treat agents as independent entities with their own identity. 45.6% still use shared API keys for agent-to-agent authentication, and 25.5% of deployed agents can create and assign tasks to other agents.3 When agents share credentials, it becomes impossible to trace which agent did what. When one agent can spawn others, a single successful injection can spread into a chain of compromised agents.11

Inkog's repository scan points the same way. It says the most common vulnerability, found in four out of five agent repositories, isn't prompt injection at all.5 A separate review of 15 open-source frameworks makes a related distinction. Human approval steps and logging are useful, but they are not the same as scoped, service-side authorization. That review maps per-agent identity, scoped access grants and fine-grained revocation directly to the OWASP risks of agent goal hijacking and privilege escalation.8

The guidance that follows is simple: assume your agent will be manipulated, and limit what it can leak or destroy.18 The benchmark results support this approach. If even the best models fail against injection most of the time, filtering inputs can only reduce the risk. Limiting what an agent is allowed to do determines how bad a failure can get.

Time is short. 81.7% of Gravitee's April respondents plan to deploy more agents within a year, and 81% say they feel pressure to ship agents before security and governance are in place.110 Gartner, as cited in a compilation of industry data, expects 40% of enterprises to demote or shut down autonomous agents by 2027 after a production incident exposes governance gaps.10

The exact incident rate is uncertain, and the reports disagree on it. The overall direction is consistent: the number of agents is growing much faster than the controls that would limit the damage from the attacks they can't yet resist.