Increasingly, enterprises are discovering that AI agents have become a primary driver of security incidents rather than a peripheral risk. Across recent surveys, 54% of enterprises report either a confirmed AI agent security incident or a near-miss in the past 12 months, signaling that agent-related failures have already moved into the mainstream of corporate risk. Other studies place the figure even higher, with 65% of organizations experiencing at least one cybersecurity incident tied to AI agents and 47% acknowledging at least one agent-related incident in formal security reporting.
AI agents have shifted from peripheral novelty to mainstream driver of enterprise security incidents
When suspected incidents are included, exposure appears pervasive: as many as 88% of organizations now confirm or suspect AI agent security or privacy failures over a one-year period. The trend line points in one direction only, as AI agent fleets expand faster than controls, pushing incident probabilities upward.
A major contributor to this escalation is the rise of shadow AI and uncontrolled agent deployment inside corporate environments. Surveys indicate that 82% of enterprises have unknown or unmanaged AI agents operating across networks, applications, and automation workflows, often without clear ownership or security review.
Agent fleets are roughly doubling in size year over year, yet monitoring coverage remains largely flat, leaving a growing proportion of agents untracked and ungoverned. In many organizations, formal decommissioning processes are absent or inconsistent, allowing dormant or orphaned agents to persist as latent liabilities long after their original use case ends. Industry data shows that only 21% of organizations have formal processes for decommissioning AI agents, leaving most enterprises without reliable end-of-life controls. Unauthorized or misconfigured agents now account for about half of recent enterprise incidents, underscoring the consequences of weak inventory practices and ad hoc deployment patterns.
The dominant attack vectors and failure modes are increasingly well understood but remain poorly mitigated. Prompt injection has emerged as the top threat to large language models and autonomous agents, enabling adversaries to hijack agent behavior, exfiltrate data, escalate privileges, and in some cases execute remote code.
Indirect prompt injection via poisoned content is especially troubling, as EchoLeak-style Copilot attacks demonstrate how zero-click exfiltration chains can be triggered simply by exposing an agent to compromised documents, web pages, or tickets. Tool misuse and over-broad tool access further compound risk, allowing agents to read, write, and exfiltrate files, including uploads to attacker-controlled services when guardrails fail.
As a result, 61% of AI agent incidents involve sensitive data exposure, making data leakage the dominant failure mode, followed by operational disruption, unintended business actions, financial losses, and service delays that propagate across business processes.
Identity and access practices amplify these risks. Most enterprises rely on shared credentials and API keys, and only about one-third assign each agent a unique scoped identity, making revocation and accountability difficult.
Environments with any credential sharing show higher incident rates, while over-privileged agents drive an increase in failures. Compounding the problem, only a minority of organizations report runtime visibility into agent behavior or incident response.
