Eighty-eight percent of enterprises confirmed or suspected an AI agent security incident in the last twelve months. Read that again. Most companies have barely had agents in production for twelve months, and almost all of them already have a story.

I've spent enough time around infrastructure and identity to recognize the shape of this problem, and it isn't novel. It's the oldest failure we have (credentials with too much access, owned by something nobody is watching) wearing a new and far more dangerous costume.

A service account that thinks for itself

When a database password leaks, an attacker has to know what to do with it. An AI agent already knows. It can plan, call APIs, read your wiki, browse the web, and chain steps together toward a goal. That's the entire pitch. It's also the threat model.

A misconfigured S3 bucket is a leaky bucket. A misconfigured agent is a leaky bucket with a pump attached and a list of where the other buckets live. The agent doesn't just hold access; it acts on it, often with broad permissions set once during development and never touched again.

The adoption curve is the part that should make you nervous. Gartner projects 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from under 5% two years ago. Google built its entire I/O 2026 keynote around an "agentic Gemini era." Microsoft shipped MAI-Code-1-Flash at Build. Every cloud vendor now sells managed agent infrastructure. Deployment is winning the race against governance, and it isn't close.

The numbers describe a governance vacuum, not a hacking spree

Here's the stat that actually explains the 88%: only 14.4% of teams report full security and IT approval for every agent they're running in production. The rest are operating outside any formal process. Meanwhile 48% of security professionals now rank agentic AI as their top attack vector for 2026, ahead of ransomware and phishing.

So the threat isn't some genius adversary. It's that we've handed standing, privileged, never-expiring access to software we don't inventory. The average enterprise is already carrying roughly 1,200 unofficial or shadow AI applications. CASB and DLP tools were never built to govern that, because they assume the thing holding data is passive. These things aren't.

Two attack classes are doing the actual damage. Prompt injection is the workhorse: malicious instructions hidden in a web page, a document, or a tool's output convince the agent to exfiltrate data or move laterally. And the supply chain is live, not theoretical, a 2026 campaign against the OpenAI plugin ecosystem harvested agent credentials from 47 enterprise deployments in one operation. If you treat an MCP server as trusted infrastructure rather than a third-party dependency, you've already lost that round.

Washington noticed before most security teams did

On June 2, the White House issued an Executive Order titled "Promoting Advanced Artificial Intelligence Innovation and Security." Section 4 directs the Attorney General to prioritize enforcement against anyone using AI agents to unlawfully access or damage computer systems. That's the government formally classifying agents as offensive capability, not a productivity feature.

The order also starts a clock. It mandates an AI Cybersecurity Clearinghouse within 30 days and a classified benchmark for frontier AI cyber capabilities within 60. Those deadlines land in early July and early August. If you sell into the federal supply chain, your procurement requirements are about to change, and waiting for the final framework is how you end up doing the gap assessment under deadline.

What I'd do this week

Treat every agent as a privileged service account, because that's what it is. Enumerate what each one holds, what it can reach, and cut it to least privilege, then put rotation on a schedule and actually enforce it. The 14.4% number tells you most of this work hasn't started.

Make observability a precondition, not a follow-up. An agent that can't emit structured, tamper-evident logs has no business near production or anything compliance touches. The distance between "the agent worked" and "the agent was auditable" is where your next incident lives, and for finance, healthcare, and critical infrastructure that gap is a regulatory finding waiting to happen.

Vet MCP servers like the dependencies they are. Pin versions, watch for supply-chain anomalies, scan tool descriptions for injection payloads. The 47-deployment campaign wasn't sophisticated; it was unopposed.

And fix the 1,200-shadow-app problem at the layer where it's actually solvable. You will not catch rogue agents at the network perimeter. Centralize credential issuance, refuse to honor anything minted outside an approved pipeline, and the shadow fleet loses its keys.

None of this is exotic. It's identity hygiene applied to software that can act on its own. The reason 88% already have a story is that almost nobody did it first.

Sources

  • https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/
  • https://aiautomationglobal.com/blog/ai-agent-security-identity-crisis-enterprise-2026
  • https://www.bvp.com/atlas/securing-ai-agents-the-defining-cybersecurity-challenge-of-2026
  • https://www.kiteworks.com/cybersecurity-risk-management/agentic-ai-attack-surface-enterprise-security-2026/