AI Threat Landscape 2026

Read the full report

Get your copy of the 2026 AI Threat Landscape Report for survey data, technical research, and case studies behind these findings.

You will also be signed up for our accompanying webinar taking place on April 8th.

Download Now

AI is moving from assistant to actor

This year’s survey shows that organizations now depend on AI for revenue, customer experience, and core operations, but many security programs are still built for static models and traditional software controls. Encryption, governance, and secure deployment are becoming common, yet runtime visibility, adversarial testing, and AI-specific incident response remain uneven. As AI systems gain autonomy, connect to tools, and make decisions across workflows, the gap between AI adoption and AI security is becoming a direct business risk.

Key findings at a glance

88%

of organizations say most or all internally operated AI models are critical to business success.

78%

say embedded third-party AI models are also business-critical.

97%

say AI projects are critical or important to revenue in the next 18 months. 92% say the same for customer experience.

69%

can definitively say whether they experienced an AI security breach in the past 12 months. 31% report uncertainty.

71%

say attacks on AI systems increased or stayed the same year over year.

76%

say shadow AI is a definite or probable problem.

93%

use open-weight models from public repositories, yet fewer than half consistently scan inbound models.

19%

perform manual or automated AI red teaming, and only 29% have a dedicated AI incident response plan.

Where attackers are getting in

Public model repositories and open-weight ecosystems

Internal and external chatbots

Third-party AI applications

Agents and tool-using systems

Connected protocols such as MCP, A2A, and AP2, where insecure defaults can turn prompt injection into data exfiltration, code execution, or credential theft

The rise of agentic AI changes the threat model

Agentic AI turns models into actors.

Once AI can browse the web, retrieve enterprise data, modify files, call tools, and coordinate with other agents, an attack is no longer just about getting a bad answer. It can become a real operational incident.

Agentic AI also moved from demos into production

AI browsers, coding assistants, workflow tools, and business platforms began taking action on a user’s behalf, browsing the web, pulling data, editing files, and completing tasks. In this model, the question is no longer only whether a model can answer. It is whether the system can act safely when it answers, especially when those actions touch sensitive data or business-critical workflows.

What Indirect prompt injections can hide

The report shows how indirect prompt injection can hide in documentation, code comments, shared documents, websites, dependencies, and tool descriptions. A poisoned README can manipulate a coding assistant. A malicious MCP server can exfiltrate secrets. A poisoned memory or RAG pipeline can keep influencing future decisions long after the initial attack.

Five threat areas every security team should watch

Data poisoning and backdoors.

Very small amounts of poisoned data can compromise model behavior, including in high-risk use cases like healthcare.

AI supply chain attacks.

Models, configs, tokenizers, plugins, tool servers, workflow files, and third-party integrations all expand the attack surface.

Prompt injection and guardrail bypass.

Guardrails still matter, but the report shows they are routinely bypassed or attacked directly.

Memory and RAG poisoning.

Agents can be manipulated through the information they retrieve, store, or summarize.

Model evasion.

Adversarial inputs continue to break vision and multimodal systems, including safety-critical applications.

AI misuse is already causing real-world harm

There is real progress across the ecosystem. The report highlights expanding work from MITRE ATLAS and SAFE-AI, CoSAI, OWASP, NIST, MAESTRO, model signing efforts, and AIBOM initiatives. These frameworks matter because they help translate abstract AI risk into practical security requirements, testing, governance, and supply chain controls. But framework adoption alone is not enough without runtime protection and operational discipline.