Category: AI Agent Security
The AI Risk Quadrant Q2 2026 report scored 100 production AI agents against a defined security baseline. Eleven passed.
These were not prototype agents in sandboxed environments. They were agents running in production enterprise systems, with real data access, real system permissions, and real consequences for failure. The report evaluated each agent against a standard covering identity, scope enforcement, logging, behavioral controls, and output verification.
The Lethal Trifecta
98 percent of agents carry what the researchers named the lethal trifecta: simultaneous access to private data, exposure to untrusted content, and active external communication capabilities. Each condition alone is manageable. All three together create the exact attack surface a prompt injection, supply chain compromise, or insider threat needs to cause serious damage.
The attacker does not need to break the agent. They need to redirect it. Untrusted content provides the injection vector. Private data provides the exfiltration target. External communication provides the exfiltration path. When all three exist simultaneously with no enforcement layer between them, the agent does not need to be compromised. It just needs to be misdirected.
Logging Without Defense
37 percent of agents assessed have logging in place but no active defense controls. This is the most common failure mode in enterprise agent deployments: teams invest in observability and assume it constitutes security. A log records what happened after it happened. It does not prevent an unauthorized action. It does not stop an agent mid-execution.
38 percent of production agents complete irreversible actions before any monitoring can fire. An irreversible action in an agentic context is any action whose consequences cannot be undone by rolling back a deployment. Sending an email. Submitting a payment. Modifying a production record. Filing a document. Each of these, once taken by an agent operating outside its authorized scope, creates downstream consequences that no post-incident review can fully remediate.
The Infrastructure Gap
The gap between 11 percent and 100 percent is not a model quality gap. The agents that failed did not fail because their underlying models were inadequate. They failed because the execution environment around them did not enforce boundaries, did not verify identity, and did not produce tamper-evident records at execution time.
Every agent that carries a verified identity, operates inside a defined behavioral profile enforced before it acts, and produces a signed record at the moment of each action directly addresses the lethal trifecta. Verified identity scopes what the agent can access. Behavioral enforcement limits what it can do with that access. A write-time record proves what it actually did versus what it was authorized to do.
89 percent of production agents are missing that infrastructure today. That is the market.
Source: AI Risk Quadrant Q2 2026 Report