AI-agent security once felt like a future problem: organizations deployed copilots, coding assistants and autonomous workflows assuming the worst outcome would be a bad recommendation or a hallucination. That assumption broke down in the first half of 2026, when multiple vulnerability disclosures and a landmark incident shifted the conversation from model safety to infrastructure compromise.
The environment agents run in
A January 2026 CyberArk survey of 500 U.S. security practitioners found only 1% had fully implemented just-in-time privileged access, while 91% reported that at least half of their privileged access remains always-on and persistent. Those figures describe the environment many AI agents now operate within: broad standing permissions, minimal runtime oversight, and credentials that outlive the task for which they were created.
That does not mean every agent is overprivileged, but many organizations are deploying agents into environments where persistent access is normal, discovery is incomplete, and runtime authorization is immature.
Three early disclosures: sanctioned tooling all made the same mistake
In the first half of 2026 three separate disclosures revealed the same control failure in sanctioned agent tooling: the agent inherits whatever permissions the host environment gives it, and tooling trusts whatever configuration is found on disk.
- Microsoft found a way for a malicious web page to reach a local MCP service inside AutoGen Studio and spawn processes on the host without credentials—simply by loading the page.
- Wiz Research discovered Amazon Q Developer could auto-load and execute MCP configuration files from any opened workspace, effectively giving an agent the developer’s full AWS environment when the environment and configuration allowed credential inheritance.
- Cato AI Labs showed a zero-click prompt injection that escaped Cursor’s command sandbox entirely and reached the underlying operating system.
From the agent’s perspective every action is authorized because it follows configuration instructions. The real question is who wrote the configuration and who checked it. Prompt injection is no longer only a model-behavior concern: in systems that combine untrusted content, tool invocation, local control planes and powerful credentials, it can become part of an infrastructure-compromise chain.
Shadow agents and a discovery problem
A parallel problem grew in the opposite direction: agents no one sanctioned at all. Adoption numbers outpaced organizations’ ability to track them.
- Verizon’s 2026 Data Breach Investigations Report found employee use of unapproved AI tools tripled to 45% of the workforce.
- Saviynt’s CISO AI Risk Report found 75% of CISOs have already discovered unsanctioned AI tools running in production.
- Netwrix’s 2026 Data and Identity Security Report showed 76% of organizations don’t fully govern or monitor nonhuman identities, including AI agents.
Together these results point to a discovery problem: employee AI use is widespread while formal inventory, ownership, monitoring and lifecycle governance have not kept pace.
Shadow AI worsens the old Shadow IT issue because an agent can call APIs, make decisions and inherit host permissions rather than merely storing data. An unsanctioned agent can combine access to internal data, untrusted inputs, external communications and tool execution in ways a standalone spreadsheet usually cannot.
More technical findings
Two additional disclosures sharpened the picture:
- Adversa AI’s GuardFall found a shell-interpretation bypass that evaded safety guards in 10 of 11 surveyed open-source coding agents: the guard read the raw command text while bash rewrote that text before execution, so the policy was evaluated against a different representation than what actually ran.
- Noma Security’s GitLost showed a GitHub agent with cross-repo read access pulling a private repository’s contents into a public comment, triggering a crafted GitHub Issue with malicious instructions. As Noma researcher Sasi Levi noted: earlier prompt injection examples were about manipulating what an agent said; GitLost is about manipulating what an agent does with its permissions.
Neither finding required a zero-day—only the gap between what a scanner sees and what an agent actually does at runtime. GitLost exemplifies the “lethal trifecta” researcher Simon Willison described: an agent with access to private data, exposure to untrusted content, and a channel to communicate externally creates conditions for high-impact data exfiltration unless a system enforces strong boundaries.
The Sysdig-documented AI-agent ransomware operation
Those conditions enabled the incident Sysdig documented in late June 2026. The Sysdig Threat Research Team described what they believe to be the first end-to-end AI-agent-driven ransomware operation, naming the operator JADEPUFFER. The underlying failure was unremarkable in its components.
The initial entry was CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow that was patched in April 2025 and added to the CISA Known Exploited Vulnerabilities catalog in May 2025. The targeted server was never updated. From there the agent pivoted to a production MySQL database and an Alibaba Nacos server using a known authentication bypass (CVE-2021-29441). It harvested API keys for OpenAI, Anthropic, DeepSeek and Gemini, and cloud credentials for Alibaba, Tencent, AWS, Google and Azure. It exploited default MinIO credentials, installed a crontab beacon, encrypted 1,342 Nacos configuration records and deleted the originals.
When faced with an authentication failure the agent showed autonomous resilience, pivoting to a functional resolution within 31 seconds. Its payloads were self-documenting code synthesized by the LLM. While a human operator established the command-and-control framework and injected root credentials from a prior breach, the lateral movement, credential extraction and final cryptographic destruction of data were entirely self-directed. The operation required zero human intervention after the initial foothold, illustrating the large-scale exploitation risk that persistent, always-on permissions facilitate today.
Why organizations remain exposed
Delinea’s 2026 Identity Security Report captures the tension: 74% of organizations say standing access for nonhuman identities and AI agents is necessary to meet uptime expectations, while 59% say they lack viable alternatives to persistent access. Organizations are more than twice as likely to use long-lived credentials (34%) as modern just-in-time authorization (16%).
Our own program reflects a discovery-first philosophy: we treat agent integrations as high-risk third-party dependencies subject to predeployment risk assessment, and we track credential lifecycles across critical infrastructure while expanding secrets-detection coverage across monitored environments. Both approaches prioritize discovery and inventory before governance: catalog what agents exist, what permissions they hold, who owns them and how long they should live.
Existing frameworks and practical steps
The OWASP Top 10 for Agentic Applications (released December 2025) maps the incidents seen here: Identity and Privilege Abuse (ASI03), Tool Misuse and Exploitation (ASI02), Agentic Supply Chain Vulnerabilities (ASI04) and Unexpected Code Execution (ASI05). The framework exists, the incidents are public, and the governance gap can be measured.
Teams that close this gap must stop treating agent access as a deployment detail and start treating it as an identity lifecycle problem with the same rigor applied to human privileged access. Agent security requires discovery, separation of workload and agent identities, constrained tool permissions, ownership, continuous monitoring and reliable offboarding. Mature just-in-time controls give an advantage, but they are not the only requirement.
Most remediation starts with access that was left in place because no one revisited it: credentials with no expiry, agents whose original owners have moved on, and tools that can run commands or pull data with little visibility into subsequent actions.
Practical checks include reviewing agents connected to production databases, sensitive data and secrets; for coding agents, ensuring guardrails evaluate the command that will actually run after shell processing; looking for nonhuman identities with no accountable owner; and paying special attention to agents that can consume untrusted content and then either send data outside the company or invoke privileged tools.
Much of this information may already exist in systems organizations operate: IAM and PAM records, endpoint logs, secrets tooling and cloud inventories will not tell the whole story but can reveal access that has no clear purpose or owner. Discovery and ownership are the first steps to preventing future infrastructure compromises.
