Gravitee's State of AI Agent Security 2026 report sets two numbers beside each other. Eighty-eight per cent of organisations reported a confirmed or suspected AI agent security incident in the previous twelve months. Eighty-two per cent of executives said they were confident that existing policies protected them from unauthorised agent actions.
Same report. Same population. Gravitee fielded that wave in December 2025 across roughly 900 executives and technical practitioners in the United States and the United Kingdom, and published on 4 February 2026. Gravitee sells agent and API governance tooling, so the framing serves the vendor. The shape of the gap, though, is corroborated by surveys with different sponsors and different samples.
Both figures can be true at once because they answer different questions. The 82% describes a document. The 88% describes an estate nobody has finished counting.
Read the 88% properly before you quote it
It is a combined figure: confirmed or suspected. In the same December wave Gravitee put the confirmed rate at 59.3%. A later Gravitee wave in April 2026, covering 750 senior technology leaders in the UK and US, asked a narrower question and reported that 54% of organisations had already suffered a security incident. Different question, different number. Treat 88% as the outer bound of a self-reported range, not a measurement.
Corroboration matters more than the headline. In January 2026 the Cloud Security Alliance surveyed 418 IT and security professionals in research commissioned and funded by Token Security. That study found 65% had experienced an AI agent-related incident in the past twelve months, with 61% reporting data exposure and 35% financial loss. Not one respondent reported zero material business impact.
The same study found 82% of enterprises had unknown AI agents running in their environment — while 68% believed they had strong visibility. Different sponsors, different samples, same fracture line: incident rates in the sixties or higher, confidence in the eighties.
The input is the attack surface
Here is why conventional controls miss this. An agent is compromised through content it was designed to consume. A sentence buried in a retrieved document. A comment in a pull request. A line in a log. A paragraph on a page the agent fetched because you told it to research something.
No binary lands. No credential is stolen. Nothing spawns that an EDR agent would flag, because the malicious instruction executes as the model's own reasoning, using tool permissions you deliberately granted. Every control in the path sees a normal read of a normal document.
The Cloud Security Alliance's AI Safety Initiative published a research note on 26 April 2026 pulling telemetry from Google, Forcepoint X-Labs, Unit 42 and the OWASP GenAI Security Project. Google, the note says, observed a 32% relative increase in malicious indirect prompt injection content between November 2025 and February 2026 across the two to three billion pages it crawls monthly. Unit 42 catalogued twenty-two payload-delivery techniques in active use.
The concealment breakdown is the detail worth sitting with. Per Unit 42's distribution as reported in that note, 37.8% of payloads were plaintext hidden from humans by placement rather than encoding, 19.8% used HTML attribute cloaking, and 16.9% suppressed rendering via CSS. Social-engineering framing appeared in 85.2% of cases. None of this is exotic. They are the oldest tricks on the web, aimed at a reader that cannot tell content from command.
A policy that forbids agents from taking unauthorised actions is not a control. It is an instruction written in the same register as the attack, delivered to the same interpreter, competing for the same attention.
What one actually looks like
Noma Security disclosed GrafanaGhost in early April 2026. An attacker crafts a URL whose query parameters land in Grafana's entry logs. When a user later asks the built-in AI assistant about those logs, the hidden instruction tells it to render an external image; the rendering request carries data to the attacker's server as a URL parameter. Noma reported that the word "intent" was enough to slip past the model's guardrails on image markdown.
Grafana patched the image renderer in its Markdown component. Grafana Labs CISO Joe McManus disputed the zero-click characterisation, saying successful exploitation required the end user to repeatedly instruct the assistant to follow the malicious instructions in the logs. Hold both positions: the mechanism is real, the reliability is contested.
The archetype remains EchoLeak, tracked as CVE-2025-32711 and rated CVSS 9.3, which Aim Labs disclosed against Microsoft 365 Copilot in June 2025. One crafted email, no user interaction, and Copilot pulled data from its own access scope out to an attacker-controlled endpoint. Microsoft fixed it server-side and reported no exploitation in the wild.
Your vulnerability feed will not carry most of these
The CSA note counted eight significant agent incidents in the first quarter of 2026 and found only one received a CVE — a Flowise remote code execution issue, CVE-2025-59528. GrafanaGhost has no CVE identifier at all. The note also records bug bounty payouts from Anthropic, GitHub and Google for prompt injection flaws in Claude Code, Copilot Agent and Gemini CLI Action that produced no public advisory and no tracking identifier.
If your intake for agent frameworks is a CVE feed, you are reading a register these findings never enter.
Why the policy feels adequate
Because the policy covers agents you know about, and the estate is larger than the list. Gravitee's December wave found only 21.9% of teams treat agents as independent, identity-bearing entities, while 45.6% still use shared API keys for agent-to-agent authentication. A quarter of deployed agents, 25.5%, can create and task other agents. CSA found only 21% of organisations have a formal process for decommissioning one.
An agent authenticating with a shared key is not an identity. It is an attribution failure waiting for an incident response team.
| Source | Sample | Fielded | Incident rate | Commercial interest |
|---|---|---|---|---|
| Gravitee, State of AI Agent Security 2026 | ~900 execs and practitioners, US/UK | Dec 2025 | 88% confirmed or suspected; 59.3% confirmed | Sells agent and API governance |
| Gravitee, April update | 750 senior technology leaders, UK/US | Apr 2026 | 54% suffered an incident | As above |
| Cloud Security Alliance | 418 IT and security professionals | Jan 2026 | 65% had an agent-related incident | Funded by Token Security |
| Arkose Labs | 300 enterprise leaders, NA/EMEA/APAC | Published 31 Mar 2026 | 97% expect a material incident within 12 months | Sells bot and agent detection |
What to do about it
- Inventory by credential, not by name. Enumerate service principals, OAuth grants, personal access tokens and API keys issued in the last eighteen months, then work out which ones an agent is holding. Asking teams to declare their agents finds the ones already on the register.
- Kill shared keys between agents. Give every agent a distinct identity with its own scoped credential. Without this, nothing downstream in your logging is attributable.
- Constrain egress at the rendering layer. Block outbound image and link fetches to non-allowlisted hosts from any agent surface that renders Markdown. That one control breaks the GrafanaGhost and EchoLeak exfiltration pattern, which depends on the agent making the outbound request for you.
- Log tool calls, not prompts. The prompt tells you what was asked. The tool call tells you what happened. Ship agent tool invocations to your SIEM with the identity, the target and the parameters.
- Gate the irreversible action, not the conversation. Human approval on a prompt is theatre. Human approval on a write to production, an outbound payment, a file deletion or a permission grant is a control.
- Red team your retrieval path. Plant benign marker instructions in the document stores, ticket systems, log sources and repositories your agents read, then see whether they come back. You are testing your pipeline, not the model vendor's.
- Supplement the CVE feed. Track vendor changelogs, the OWASP Top 10 for Agentic Applications published in December 2025, and the disclosure blogs for every framework in your stack.
The clock is already running
The remaining elements of the EU AI Act became enforceable on 2 August 2026 and, as SecurityBrief reported, the Digital Omnibus deferred the high-risk deadlines but left Article 50 untouched. Disclosure of AI interaction and machine-readable marking of generated content are live obligations, not future ones.
Expect the confirmed rate in the next survey wave to climb and the suspected rate to fall. That will not mean attacks increased. It will mean logging finally caught up with what was already happening — and that the 82% who trusted the policy found out what it did not cover.
