AI Agent Security: Enterprises Deploy Faster Than They Can Defend

The readiness gap

Enterprises have handed AI agents real authority. Agents can run tasks, query databases and change code. The security programs meant to contain that authority have not kept up. Most organizations plan to put agentic AI into business functions, yet only 29% say they are prepared to secure those deployments 1. That shortfall leaves openings at model interfaces, tool integrations and the software supply chain 1.

Practitioners feel it. Darktrace's State of AI Cybersecurity 2026 found that 92% of security professionals are concerned about AI agents in the workforce and what they mean for security 2. The worry follows from how agents are provisioned. They often hold broad permissions across many systems, reaching sensitive data, business-critical applications, tokens, APIs, and even IT and security tooling 2.

How agents get turned against their owners

Agents differ from earlier software risks because they act on their own. Agentic systems run in observe-orient-decide-act loops and talk to other agents through standardized protocols 1. If an agent is compromised, it can execute unauthorized commands, exfiltrate data and move laterally across infrastructure 1.

One documented case shows how easily this can happen. A GitHub Model Context Protocol (MCP) server allowed a malicious issue to plant hidden instructions. Those instructions hijacked an agent and triggered data exfiltration from private repositories 1. Developer teams should take note. MCP integrations are spreading quickly because they make it easy to connect agents to tools. That same convenience means any text an agent reads, such as an issue, a document or a web page, can carry instructions.

Darktrace adds a quieter version of the problem. An agent can behave exactly as designed and still create risk if it touches sensitive information in an unexpected context 2. Respondents ranked exposure of sensitive data as their top generative AI concern (61%), ahead of data security and policy violations (56%) and misuse or abuse of AI tools (51%) 2. Darktrace therefore argues for continuous oversight of agent behavior rather than one-time approval 2.

The agents nobody approved

Gartner lists the problem as a top cybersecurity trend for 2026 and points to a blind spot: shadow AI agents. Employees are building automations outside formal oversight. Security teams may not know these agents exist, or may see them without any way to understand or control them 3. Gartner reports that 75% of organizations have seen unauthorized use of AI coding assistants, and 50% report employees using public SaaS generative AI agent platforms 3. Business demand is strong, so Gartner says security leaders cannot simply slow adoption down 3.

The sources mostly agree on the threat. They differ in where they place the center of gravity:

• Help Net Security focuses on technical exposure: protocols, supply chains and agent hijacking 1.
• Darktrace focuses on permissions and behavioral monitoring 2.
• Gartner focuses on governance and visibility 3.

The view from law enforcement

Interpol takes a more measured line. Bjorn R. Watne, Interpol's global CISO, told CNBC that AI is amplifying existing criminal techniques rather than reinventing them 4. Scammers can work on many victims at once, and better translation and synthetic digital identities make fraud harder to tell apart from legitimate contact 4. He also flagged agentic AI as a distinct new risk, because these systems gain access and the ability to act on users' behalf 4. His advice is to identify the most critical assets and tailor defenses to the specific threats against them 4.

What it adds up to

The sources agree that agents are being deployed faster than they can be defended. Read together, they also suggest the core problem is less about novel AI exploits and more about long-standing security failures applied to a new kind of actor. Those failures include over-permissioned identities, untrusted input reaching privileged systems, and unmanaged software inside the network. The MCP hijack is essentially an injection flaw. Shadow agents are shadow IT that can act on their own.

The practical response follows from that framing:

• Treat agents as identities with least-privilege access.
• Inventory the agents running in the environment, including unsanctioned ones.
• Treat every piece of content an agent reads as potentially hostile.
• Watch agent behavior continuously rather than approving deployments once.

The 29% preparedness figure suggests most enterprises are still catching up 1. Organizations that close this gap before an incident forces them to will have a meaningful advantage over those that wait.