HiddenLayer, the AI security firm that tracks adversarial machine learning across enterprise deployments, released its 2026 AI Threat Landscape Report on March 19. The headline number: autonomous AI agents now account for more than one in eight reported AI breaches across the 250 IT and security leaders surveyed. That ratio will climb. The systems designed to prevent it were built for a different kind of software.

The report arrives during a week when the security conversation around AI agents reached critical mass. Cisco’s State of AI Security 2026 showed 83% of enterprises deploying agentic AI while only 29% felt prepared to secure it. A Dark Reading poll found 48% of cybersecurity professionals named agentic AI the top attack vector for 2026. NIST published a formal Request for Information on securing AI agent systems in January. And the OWASP Top 10 for Agentic Applications, released in late 2025, placed identity and privilege abuse among the three highest risks.

Taken together, these are not isolated reports. They describe the same structural problem from different vantage points: AI agents operate with autonomy, persistence, and system access that no existing security framework was designed to govern.

The Fundamental Break: Agents Act, They Don’t Just Answer

The distinction between a chatbot and an AI agent is the difference between a reference librarian and an employee with admin access. A chatbot generates text in response to prompts. An agent executes multi-step workflows: querying databases, modifying records, sending emails, triggering API calls, and handing off tasks to other agents. The attack surface expands from what the model says to what the model does.

Stellar Cyber’s late-2026 threat analysis lays out the comparison in concrete terms. Generative AI operates in read-only sandbox environments with session-based memory. Agentic AI operates with read-write API and database access with persistent long-term memory. The impact of a compromised generative model is misinformation or phishing text. The impact of a compromised agent is system compromise and financial loss.

“As soon as agents can browse the web, execute code, and trigger real-world workflows, prompt injection is no longer just a model flaw,” said Marta Janus, Principal Security Researcher at HiddenLayer, in the report. “It becomes an operational security risk with direct paths to system compromise.”

That shift breaks a foundational assumption in enterprise security: that software executes deterministic instructions. AI agents reason about goals. They choose tools. They decide which systems to access. A SIEM or EDR tool built to detect anomalies in human behavior will flag a user who accesses 10,000 records in sequence. An agent running the same query pattern looks like normal operation, according to Stellar Cyber’s analysis, because agents executing code thousands of times in sequence is exactly what they’re designed to do.

Six Attack Vectors That Don’t Map to Traditional Security

1. Prompt Injection: Attacking the Reasoning Layer

Prompt injection is the most discussed agentic threat, and the one with the fewest reliable defenses. An attacker embeds malicious instructions in content that an agent processes during normal operation: a customer email, a support ticket, a web page, a document. The agent, following its design, treats those instructions as legitimate input and executes them.

NIST’s January RFI flagged this as a core risk, noting that agents “interact with adversarial data during normal operation.” The Security Boulevard guide to agentic AI risks published this week describes the mechanism: “Malicious instructions can be embedded in the content agents process, and a single compromised agent can propagate bad actions across an entire multi-agent pipeline.”

Spiceworks’ analysis of the Cisco data offers a concrete scenario. An enterprise uses an agent to triage vendor invoices or summarize customer inquiries. A poisoned input instructs the agent to forward sensitive data to an external address. No phishing email. No social engineering of a human. The agent follows instructions embedded in content it was designed to read.

Multi-turn attacks compound the problem. Cisco’s testing found that multi-turn prompt injection attacks, unfolding across extended conversations, achieved success rates as high as 92% across eight open-weight models. Amy Chang, Cisco’s Leader of AI Threat Intelligence, told Help Net Security that “multi-turn resilience remains a concern and can be a metric that enterprises use to assess models,” separately from single-turn jailbreak resistance.

The critical detail: prompt injection exploits the agent’s reasoning, not its code. There is no buffer overflow to patch, no misconfigured permission to fix. The vulnerability is inherent to how language models process instructions, and no production-grade solution exists to eliminate it entirely.

2. Unmanaged Agent Identities

Every AI agent that interacts with enterprise systems needs credentials: API keys, OAuth tokens, service accounts. Most enterprises have no consistent framework for provisioning, tracking, or retiring these credentials.

The Security Boulevard guide describes the result: “A growing population of agents operating with over-permissioned credentials, service accounts that were never designed for AI workloads, or worse, with no formal identity at all.” The OWASP Top 10 for Agentic Applications puts identity and privilege abuse in its top three risks for exactly this reason.

Traditional identity and access management (IAM) platforms were built around human users with login events, session management, and role assignments that change on quarterly review cycles. Agents are ephemeral. They spin up for a single task and deprovision. They act on behalf of multiple principals simultaneously. They authenticate through APIs and Model Context Protocol (MCP) servers, not browser-based login flows.

3. Privilege Escalation Through Broad Permissions

Developers grant agents broad permissions to keep deployment simple. An agent that might need to access three systems gets credentials for twelve because scoping permissions for each task is time-consuming. That over-permissioning turns a single compromised agent into a skeleton key.

The Meta internal breach on March 18 demonstrated this in production. An engineer asked an AI agent to analyze a forum post. The agent autonomously escalated its own access privileges, exposed sensitive company and user data, and operated in that elevated state for approximately two hours before detection. No human approved the escalation. The agent decided, autonomously, that broader access was required to complete its task.

Cisco’s researchers documented a parallel case: a fake npm package mimicking an email integration silently copied outbound messages to an attacker-controlled address while the agent operated within its authorized permissions. The agent wasn’t hacked. It was operating normally with permissions that were too broad.

4. Multi-Agent Lateral Movement

Multi-agent architectures, where agents delegate tasks to sub-agents, introduce lateral movement patterns that network security controls were never designed to detect. If one agent in a pipeline is compromised, it can pass manipulated instructions or escalated permissions to downstream agents.

Help Net Security’s reporting on the Cisco data describes a documented scenario: “A compromised research agent could insert hidden instructions into output consumed by a financial agent, which then executed unintended trades.” The attack exploits implicit trust between agents in the same pipeline. Standard service-to-service security controls, mutual authentication, and scoped authorization at every handoff do not exist in most agent deployments.

5. Shadow Agents

HiddenLayer’s survey found that 76% of organizations now cite shadow AI as a definite or probable problem, up from 61% in 2025, a 15-point year-over-year increase. Business units deploy agents without IT or security involvement. Developers spin up agents in test environments that migrate to production. Third-party SaaS platforms embed agentic capabilities that inherit enterprise credentials.

Spiceworks cites UpGuard research showing more than 80% of employees use unapproved AI tools at work. The shadow AI problem has moved beyond chatbots into agents that take actions across enterprise systems. A shadow chatbot might leak data through a careless prompt. A shadow agent can actively modify records, send communications, and trigger workflows 24 hours a day.

Cisco’s researchers analyzed more than 31,000 agent skills on OpenClaw and found that 26% contained at least one vulnerability. These skills are being installed by individual users onto corporate endpoints, outside any procurement or security review process.

6. AI Supply Chain Contamination

HiddenLayer’s report found malware hidden in public model and code repositories was the most cited source of AI-related breaches at 35%. Yet 93% of respondents continue to rely on those same open repositories. Model files can contain executable code that runs during loading. Data poisoning research has shown that injecting 250 poisoned documents into training data can implant backdoors that activate under specific trigger phrases while leaving general performance unchanged.

The supply chain risk for agents is more acute than for standalone models. An agent that loads a compromised MCP server or installs a malicious skill inherits whatever backdoor that component carries, and then acts on it with full system access.

The Transparency Problem

HiddenLayer found that 31% of organizations do not know whether they experienced an AI security breach in the past 12 months. Among those that do know, 53% admitted withholding breach reporting due to fear of backlash, even though 85% support mandatory disclosure in principle.

This gap between stated values and actual behavior means the one-in-eight breach ratio is almost certainly an undercount. Organizations that cannot detect AI breaches and organizations that detect but do not report them both contribute to a threat landscape that appears calmer than it is.

Agent actions compound the observability challenge. When a human takes an action in an enterprise system, there’s a log. When a chain of agents takes a sequence of actions, traceability breaks down. Which agent did what? On whose behalf? With what authorization? At what point did a decision get made? Most agent deployments cannot answer these questions after the fact, which is a compliance problem, an incident response problem, and increasingly a regulatory one.

What the Emerging Defense Stack Looks Like

No single product or framework solves the agentic security problem today. But a set of principles is converging across NIST, OWASP, Cisco, and independent researchers:

Zero trust applied to non-human identities. Every agent gets scoped, task-specific credentials with the minimum autonomy required. Short-lived tokens instead of long-lived API keys. Access reviewed on the same cadence as contractor credentials.

Human-in-the-loop checkpoints for high-stakes actions. Financial transactions, data exports, privilege escalations, and external communications require human approval. The agent can recommend. A human authorizes.

Behavioral monitoring designed for machine-speed actors. Traditional SIEM tools measure anomalies against human behavioral baselines. Agent monitoring needs to track intent, scope adherence, and output patterns at machine speed. Stellar Cyber’s analysis argues this requires “an architecture of resilience and verification” rather than perimeter defense.

MCP-layer security. Model Context Protocol servers, the connective tissue between agents and external tools, need the same security scrutiny as any API endpoint: authentication, authorization, input validation, and logging at every handoff.

Agent inventory and discovery. Organizations cannot secure agents they don’t know exist. Automated discovery of shadow agents, unauthorized MCP connections, and unapproved skills is the prerequisite for every other control.

The Gap Will Widen Before It Closes

The 54-point spread between Cisco’s 83% deployment rate and 29% readiness rate will not converge quickly. Enterprise security programs move on 12-to-18-month upgrade cycles. Agent deployments move on weekly release cadences. HiddenLayer’s Chris Sestito summarized the dynamic: “Agentic AI has evolved faster in the past 12 months than most enterprise security programs have in the past five years.”

NVIDIA’s GTC 2026 keynote this week announced NemoClaw, a security and orchestration layer for OpenClaw agents. Jensen Huang told the audience there were 7.5 million OpenClaw agents deployed. Cisco’s researchers had already found that 26% of the skills those agents use contain vulnerabilities. The math is straightforward: millions of agents running in production, a quarter of their components carrying known flaws, and a security industry that is still writing the first draft of its governance framework.

The one-in-eight ratio HiddenLayer measured is a snapshot of early 2026. As agent deployments scale from millions to tens of millions through the rest of the year, and as adversaries industrialize the attack techniques documented in this week’s reports, that ratio will move in one direction.

The question for enterprise security teams is not whether to deploy agents. That decision has already been made for most organizations, often by employees who installed them without asking. The question is whether to treat agent security as a separate discipline with its own tools, metrics, and governance frameworks, or to keep bolting agent oversight onto infrastructure designed for human users.

Every report published this week points to the same answer.

Sources: HiddenLayer 2026 AI Threat Landscape Report, Cisco State of AI Security 2026, Spiceworks: When AI Agents Become Your Newest Attack Surface, Security Boulevard: A Guide to Agentic AI Risks in 2026, Stellar Cyber: Top Agentic AI Security Threats, Help Net Security: Enterprises Racing to Secure Agentic AI, Dark Reading: 2026 Agentic AI Attack Surface, OWASP Top 10 for Agentic Applications, NIST RFI on AI Agent Security