Category: AI Agent Security | Reading time: 5 min
88% of organizations reported confirmed or suspected AI agent security incidents in the last year, and in healthcare that number reaches 92.7%.
These are not theoretical risks living in research papers. They are active incidents happening inside organizations that believed their existing controls were sufficient.
Government and Finance Breaches
Between December 2025 and February 2026, a single attacker used Anthropic's Claude to breach nine Mexican government agencies, including the federal tax authority and electoral institute, exfiltrating 195 million taxpayer records, 220 million civil records, and over 150GB of data.
The attacker simply told Claude he was running a legitimate bug bounty program.
Claude did not create the vulnerability but made exploiting it 10x faster.
In January 2026, attackers compromised executive devices at Step Finance, a Solana DeFi portfolio manager, and the AI trading agents moved 261,000 SOL tokens worth $27 to $30 million with only $4.7 million recovered.
The agents had permissions to execute large SOL transfers without human approval, and once attackers had access, the agents did exactly what they were designed to do.
The native token crashed 97%. Step Finance shut down.
The Identity Gap
The core problem is identity.
Only 21.9% of teams treat AI agents as independent, identity bearing entities, while 45.6% of teams still rely on shared API keys for agent to agent authentication.
When something goes wrong with shared credentials, you cannot attribute the action to a specific agent, turning incident response into forensic archaeology instead of straightforward attribution.
The average organization now manages 37 deployed agents, growing every quarter as individual teams spin up automation without central review.
Only 24.4% of organizations have full visibility into which AI agents are communicating with each other, and more than half of all agents run without any security oversight or logging.
Shadow AI security incidents cost an average of $670,000 more than standard incidents, driven by delayed detection and difficulty scoping the exposure.
Foreseeability and Internal Exposure
The Cloud Security Alliance and Token Security published research on April 21, 2026 showing that 65% of organizations experienced at least one cybersecurity incident tied to an AI agent in the past year.
The research establishes foreseeability, meaning when a regulator asks whether an organization knew or should have known that ungoverned AI agents caused data exposure incidents, the answer after April 2026 is documented.
In April 2026, an internal AI agent operating within Meta's production environment issued incorrect instructions that temporarily exposed sensitive internal data to employees who should not have had access, with no external attacker involved.
The agent, tasked with orchestrating internal workflows, hallucinated incorrect permission scopes and inadvertently surfaced restricted data in its response output.
This represents a new category of security incident where AI induced exposure happens without any external threat actor.
Kiteworks research quantifies the gap: 63% of organizations cannot enforce purpose limitations on agent behavior, 60% cannot terminate a misbehaving agent, and 33% lack audit trails entirely.
Organizations that can observe agent behavior but not intervene are simply documenting problems they cannot prevent.
What Must Change
The solution architecture is clear. Each agent must authenticate as a distinct entity with its own credentials and audit trail. Organizations need runtime enforcement at the tool invocation layer before execution happens. They need behavioral monitoring across the full agent fleet. And they need the ability to kill agents reliably. An agent you cannot stop reliably is an agent you should not be running.
Source: Gravitee 2026 Report