Answer box
The 2026 AI threat landscape splits into three actor classes, each with distinct attack patterns. External attackers run AI-assisted reconnaissance, jailbreaks, and indirect prompt injection through documents, retrieval indexes, and tool descriptions. Careless insiders leak data into copy-paste boxes and connector-style integrations nobody put in the inventory. The third class is the one most security programs still under-model: AI agents themselves, drifting from intent because of poisoned memory, hijacked goals, or over-scoped tokens. Mapping AI threats enterprise-wide means accepting the surface is not a model. It is a fleet of semi-autonomous workers running with your credentials.
How the threat landscape shifted in 2024-2026
Three shifts reshaped the problem between 2024 and mid-2026. Most enterprise threat models have absorbed only the first.
From "AI as one app" to "AI as a layer inside every app and a fleet of agents." Two years ago the AI threat conversation was about one chat product procured by one team. Today AI is a substrate inside your CRM, IDE, ticketing, and data warehouse. Alongside it, you run agents: long-lived processes holding tokens, calling tools, writing to memory between sessions. The unit of risk is no longer a prompt. It is an agent with a credential and a job.
From manual attacks to AI-assisted exfiltration. Unit 42's 2026 IR data puts AI-assisted intrusion campaigns at roughly four times the tempo of human-driven attacks during the active phase. Recon-to-exfiltration windows that used to give you days give you hours. Detection budgets sized for the old tempo will miss.
From point-in-time leaks to persistent supply-chain compromise. The interesting attacks of 2026 are not single-shot dumps. They are persistence in the AI supply chain: a poisoned MCP server description rewriting tool arguments, a RAG corpus seeded with adversarial documents that fire on a specific query, a memory store written to once that influences behavior weeks later. Not bugs. Footholds.
The ten AI threats that matter for enterprises in 2026
We track more categories internally, but these show up repeatedly in real incidents and have the widest control gap. Numbering reflects rough order of likelihood, not severity.
-
Shadow AI sprawl
You cannot defend traffic you cannot see. The Cloud Security Alliance's 2026 Shadow AI Agents Report puts 79% of organizations without effective visibility into agent-originated traffic on their own networks. A team adopts a tool or internal framework, nobody files a procurement ticket, and within a quarter the agent is reading from a sensitive store. You cannot run a tabletop on a system you have not inventoried.
-
Sensitive data leakage to LLMs
Two flavors: employee paste (source code, customer records, deal terms into a public model) and the quieter one — a vendor product that silently added an AI feature and now sends your data through a third-party endpoint you never reviewed. Consequence: loss of control over data residency, training opt-out, and breach disclosure. Ponemon's 2024 Cost of a Data Breach pegged the average at $4.88M; AI-channel breaches trend to the upper quartile because of disclosure ambiguity.
-
Direct prompt injection
Jailbreaks and instruction override against a user-facing model. The threat the press writes about. It matters for products with adversarial users (consumer chat, public assistants), but for internal enterprise agents the user is not the adversary, so the blast radius is smaller than headlines suggest. Where it does matter: when a single jailbreak unlocks tools the user shouldn't reach. Control the tools, the jailbreak loses its prize.
-
Indirect prompt injection
The damage moves here. Adversarial content lands in a document, retrieved web page, calendar invite, or RAG index and instructs the agent to act against the user's interest. The user never sees the payload — it sits in the model's context, not their screen. The attacker doesn't need access to your network, only to a surface your agents read. The hype is on jailbreaks; the damage is on indirect injection.
-
Tool poisoning and MCP supply chain compromise
Tools are described in text the model reads. A compromised tool can hide instructions in its description, parameter docstrings, or error messages and steer the agent into calling other tools with bad arguments. MCP sharpened this category because tool definitions are now portable across hosts. See tool poisoning as a supply-chain attack pattern. The agent does the wrong thing while looking like it did the right thing.
-
Agent goal hijack
An autonomous agent receives a task, gets nudged off the rails mid-run, and pursues a different objective using your credentials. The nudge can come from any input channel: indirect injection, poisoned memory, malicious tool response. The planner rewrites its own intent. The nine-second database delete incident is canonical: the agent didn't malfunction, it executed a hijacked plan competently.
-
Agent identity reuse and token sprawl
The path of least resistance is a long-lived service account with broad scopes. Multiply by a fleet and you have static, over-privileged identities sitting in process memory and config files. As we argued in agentic identity is the new perimeter, the traditional "non-human identity" model breaks down. The credential blast radius is one no IAM dashboard reflects.
-
Agent-to-agent injection at the handoff bus
Multi-agent systems pass plans, summaries, and partial outputs between agents. Each handoff is an injection surface. A compromised upstream agent plants instructions in the payload that a downstream agent reads as task description. See A2A trust and inter-agent prompt injection. Traditional service auth doesn't help — the attack is in the data.
-
Memory poisoning persistence
Agents that retain state store summaries, preferences, and learned facts. An attacker who writes to memory once gets a foothold that fires on a future, unrelated session. The user prompts something benign next week; the agent acts on a poisoned recollection. This breaks point-in-time scanning because the malicious context was planted long before the harmful action.
-
Compliance and audit failure
Not an attack in the classical sense, but a threat to the business outcome. When an auditor asks what an agent did, why, on whose behalf, with what data, your logs need to answer in minutes. Most stacks log model calls but not tool arguments, memory reads, or chain of intent. Even when nothing was breached, you cannot prove it.
Which of these are most likely to hit you first
Three predictions for the next twelve months, biased toward what we see in incident calls rather than research papers.
One: browser-based AI tools, data leakage first. Not because it is sophisticated, but because volume is enormous and the controls are usually a DLP policy written for a different decade. The first AI incident most enterprises disclose in 2026 will be a leak, not an exploit.
Two: autonomous agents in production, goal hijack second. The moment an agent has tools that change state — write a database, send mail, spend money — you are one indirect injection away from a hijacked plan. Read-only agents skip this for another year. Write-capable agents with no inline inspection will not.
Three: RAG over any external or semi-trusted corpus, indirect injection third. Customer uploads, scraped web content, vendor knowledge bases, ticket histories — any retrieval source you do not control is an injection surface. Cheap to attempt, hard to attribute. Stress-test against your footprint with our AI agent risk calculator before committing budget.
What each threat looks like in practice
Top five threats by likelihood, mapped to the attack vector you defend against and the single control that does the most work.
| Threat | Attack vector | Typical consequence | Primary control |
|---|---|---|---|
| Shadow AI sprawl | Unmanaged agent and model adoption, vendor side-channels | Sensitive data in systems not on the inventory; no disclosure pathway | Continuous AI discovery from network and identity telemetry |
| Direct prompt injection | Adversarial user prompts targeting guardrails to unlock restricted tools | System-prompt disclosure, misuse of high-privilege tools | Capability-scoped tokens per tool call; jailbreak unlocks nothing new |
| Indirect prompt injection | Adversarial content in retrieved docs, web pages, emails, RAG indexes | Agent acts on attacker instructions; exfiltration via tool calls | Inline inspection of inputs and tool calls at sub-50ms p99 |
| Tool poisoning / MCP supply chain | Compromised tool definitions, parameter docs, error responses | Wrong tool called, or right tool called with bad arguments | Signed tool manifests, allowlists, inspection on load and update |
| Agent goal hijack | Injection in any input channel; poisoned memory; bad tool output | Agent executes a coherent but unauthorized plan with valid creds | Kill switches with drills, intent diff alerts, human approval on irreversibles |
The controls that move the needle most
Five controls, ranked by what actually closes incidents in production. These are where the ROI is least debatable.
Continuous AI discovery. Inventory drives every other control. If you build inventory from procurement and SSO logs, you are looking at last quarter's footprint. The discovery pass that matters runs against egress, identity telemetry, and code repos, continuously. It catches the agent a developer stood up Tuesday before that agent reads production.
Inline inspection at sub-50ms p99. Out-of-band scanning catches yesterday's leak. Inline inspection — in the prompt and tool-call path with a latency budget tight enough that teams don't route around it — catches today's. Above 50ms, teams bypass or downgrade and you lose coverage. This is where indirect injection and tool poisoning get caught.
Capability-scoped tokens per tool call. The biggest blast-radius reduction is moving from long-lived agent credentials to short-lived, capability-scoped tokens minted per invocation. Each token carries only what the next call needs. A hijacked agent leaks one drawer, not the building.
A2A signing and inspection. Inter-agent handoffs need cryptographic provenance and content inspection on receipt. Sign at the sending agent's identity, verify on receipt, treat free-text as untrusted. Without this, multi-agent systems have no internal trust boundary.
Kill switches with monthly drills. A kill switch you have never pulled does not work. Monthly drills against a real agent, with timing, are the difference between a contained incident and a disclosed one. Tie the drill to your IR runbook.
What to do this quarter
Three moves, in order. Don't try to do all ten threats at once.
Inventory and classify by threat exposure. Stand up continuous discovery against egress and identity. Tag each AI system by which of the ten threats applies — most are exposed to three or four, not all ten. Classification is what lets you prioritize.
Deploy inline inspection on your highest-risk surface first. Usually the surface where an agent has write capability against a system of record. Start there, prove the latency budget holds, then expand. Don't cover every surface in quarter one.
Run a tabletop on your top-likelihood scenario. For most enterprises that is indirect-injection-driven exfiltration or a goal hijack in a write-capable agent. Run it end-to-end: detection, containment, kill switch, post-incident provenance. The gap between runbook and reality is next quarter's work.
FAQ
How does this differ from traditional cybersecurity threats?
Traditional threats target systems with fixed behavior. AI threats target systems whose behavior is determined at runtime by their inputs, including untrusted inputs the system was designed to read. You can no longer assume "what the system does" is fully described by its code. That single change cascades into every control.
Where do nation-state actors fit?
They fit, especially in tool and model supply chain compromise where patience pays off. But most damage we see across IR calls is not nation-state. It is insiders pasting into the wrong box and agents drifting on poisoned context. Plan for both, but don't miss the boring one.
Can existing IR runbooks handle these?
Partially. Identification, containment, eradication, recovery still apply. What breaks: evidence collection (you need tool-call and memory provenance, not just network logs), containment scope (killing one agent may not stop a peer with shared memory), and root cause (the injection may be in a document you do not own). Most runbooks need an AI-specific annex, not a rewrite.
What frameworks cover these coherently?
The OWASP Top 10 for Agentic Applications 2026 (ASI01-ASI10) is the categorization anchor we recommend; it maps cleanly to the ten threats above. See our enterprise annotation of the OWASP Agentic Top 10. The NIST AI Risk Management Framework gives you the governance scaffolding around it.
Do we need new tools, or new policies?
Both, but policy comes first or the tools land on undefined targets. Write the policy that says which agents hold which data, which tools require approval, and your kill switch criteria. Then buy tooling that enforces it. Tools without policy produce dashboards nobody owns.
How often should we re-baseline?
Quarterly minimum; monthly is realistic with continuous discovery running. Threat-model reviews on a six-month cadence, tied to a tabletop. Re-baseline immediately after any major framework or platform change in your agent stack — those events reset the assumptions underneath existing controls.