AI Agents in the Enterprise: Security Risks Boards Aren't Seeing Yet

The enterprise adoption of AI agents is outpacing the security infrastructure designed to govern them. According to the Gravitee State of AI Agent Security 2026 report, 80.9% of technical teams have moved past planning into active testing or production deployment of AI agents. Only 14.4% of those agents went live with full security and IT approval. This is not a future risk - it is a present exposure that most boards have not yet been briefed on.

For a foundational understanding of what AI agents are and why they differ from chatbots, see our guide for business leaders. For the specific security distinctions between agents and chatbots, see our companion analysis on what the agent-chatbot distinction means for your security posture.

Key Takeaways

• Over half of deployed AI agents operate without consistent security oversight or logging, according to 2026 industry data
• Only 29% of organizations report being prepared to secure their agentic AI deployments (Cisco State of AI Security 2026)
• 82% of executives feel confident their existing policies protect against unauthorized agent actions - field data contradicts this
• NIST issued a formal Request for Information on AI agent security considerations in January 2026, signaling regulatory attention
• Prompt injection ranked as the top vulnerability on OWASP's 2025 LLM Top 10 - and the risk compounds in agentic systems where actions follow instructions
• 63% of employees who used AI tools in 2025 pasted sensitive company data into personal chatbot accounts; agents with system access amplify this exposure

The Gap Between Executive Confidence and Operational Reality

The most dangerous finding in the 2026 data is the disconnect between what leadership believes and what is actually happening.

A survey cited in the Gravitee report found that 82% of executives feel confident their existing security policies protect against unauthorized agent actions. But operational data tells a different story: over half of deployed agents operate without security oversight or logging. Only 21% of executives have complete visibility into agent permissions, tool usage, or data access patterns.

This gap exists because most organizations extended their existing application security frameworks to cover AI agents. The problem is that agents are not applications. They make autonomous decisions, call external tools, and can be manipulated through their inputs in ways that traditional software cannot. A firewall does not stop a prompt injection. An API gateway does not prevent an over-permissioned agent from accessing data through a legitimate tool call.

Why Agents Are Different from Chatbots - From a Security Perspective

A chatbot processes text and returns text. The security perimeter is the conversation window. An agent processes text, makes decisions, accesses file systems, calls APIs, sends emails, and executes multi-step workflows. The security perimeter is the entire set of systems the agent can touch. We explore this distinction in depth in our analysis of agents vs. chatbots from a security posture perspective.

Three properties of agents create fundamentally new risk categories.

Autonomous action. Agents take actions without human approval for each step. A compromised or misdirected agent does not pause and ask permission before exfiltrating data through a legitimate tool call - it follows its instructions. The IBM AI Agent Security guidance recommends just-in-time permissions, where access is granted only for the duration of a specific task and revoked immediately after. Most deployments do not implement this.

Tool and system integration. Agents connect to APIs, databases, cloud services, email platforms, and file systems. Each integration is a potential entry point. The Cisco State of AI Security 2026 report documented how Model Context Protocol (MCP) - a common standard for connecting AI models to external tools - has rapidly expanded the attack surface. Researchers identified tool poisoning, remote code execution flaws, overprivileged access, and supply chain tampering within MCP ecosystems. A fake npm package mimicking an email integration was found silently copying outbound messages to an attacker-controlled address.

Indirect prompt injection. Traditional prompt injection involves a user directly manipulating an AI system's behavior. Indirect prompt injection is more dangerous: adversarial instructions are embedded in documents, emails, web pages, or retrieved data that the agent processes as part of its normal workflow. The agent treats the injected instruction as legitimate input and acts on it. In one documented case, a malicious GitHub issue injected hidden instructions that hijacked an agent and triggered data exfiltration from private repositories.

The Attack Surface in Practice

The documented incidents from late 2025 and early 2026 illustrate what happens when agent security is treated as an afterthought.

In February 2026, Check Point Research disclosed critical vulnerabilities in Claude Code, Anthropic's command-line AI development tool. One flaw allowed remote code execution the moment a developer opened a project containing a malicious configuration file - the attack executed before any trust dialog appeared on screen. A second flaw bypassed MCP consent mechanisms, auto-approving all MCP servers and triggering execution on launch. Both were patched, but the disclosure timeline stretched from July 2025 to January 2026 - months during which the vulnerabilities were exploitable.

The OpenClaw malicious skills crisis represents the largest confirmed supply chain attack targeting AI agent infrastructure to date. Security researchers confirmed over 1,100 malicious skills across ClawHub, the package registry for the OpenClaw framework - approximately one in five packages in the ecosystem. Attack techniques included typosquatting and automated mass uploads - the same methods that have plagued software supply chains for years, now applied to AI agent tooling.

Cisco's report documented state-sponsored actors integrating AI into offensive operations. A China-linked group reportedly automated 80 to 90% of a cyberattack chain by jailbreaking an AI coding assistant and directing it to scan ports, identify vulnerabilities, and develop exploit scripts. For a broader view of how AI is accelerating cyber threats, see our board briefing on AI-powered cyber attacks in 2026.

The IBM 2026 X-Force Threat Intelligence Index reported a 44% increase in attacks beginning with exploitation of public-facing applications, driven by missing authentication controls and AI-enabled vulnerability discovery. The McKinsey Lilli breach - where a 1998-era SQL injection reportedly exposed an enterprise AI platform - demonstrated how traditional vulnerabilities become far more dangerous when they affect AI systems containing unstructured conversational data.

Shadow AI: The Risk You Cannot See

The AIUC-1 Consortium briefing, developed with input from Stanford's Trustworthy AI Research Lab and over 40 security executives, documented that 63% of employees who used AI tools in 2025 pasted sensitive company data - including source code and customer records - into personal chatbot accounts. The average enterprise has an estimated 1,200 unofficial AI applications in use, with 86% of organizations reporting no visibility into their AI data flows.

Shadow AI breaches cost an average of $670,000 more than standard security incidents, driven by delayed detection and difficulty determining the scope of exposure.

This problem intensifies with agents. A chatbot in a browser tab can only process what a user manually pastes into it. An agent with file system access can read entire directories of sensitive documents. An agent with email connectivity can access inboxes containing client communications, financial data, and legal correspondence. The data exposure surface of an agent is orders of magnitude larger than a chatbot - and most organizations have no visibility into what data their agents are processing. For organizations that have not yet formalized their AI data governance, our analysis of AI data governance as an extension of existing enterprise frameworks provides the foundation.

What Existing Frameworks Do Not Cover

Most enterprise security frameworks - ISO 27001, NIS2, DORA - were designed for systems where actions are initiated by humans or by deterministic software. AI agents sit in a category that current frameworks do not explicitly address.

ISO 27001 covers access control, risk assessment, and information security management. It does not address the specific risks of autonomous AI systems that make decisions about which tools to call, which data to access, and which actions to take. NIS2's ten minimum security measures include supply chain security and access control - both relevant - but do not provide specific guidance on governing AI agent behavior within enterprise perimeters. For organizations operating under NIS2 or Sweden's Cybersecurity Act, our comprehensive guide to Sweden's Cybersecurity Act 2025 covers the compliance baseline.

NIST signaled awareness of this gap in January 2026 by issuing a formal Request for Information on security considerations for AI agent systems. The RFI received 932 comments before its March deadline, indicating significant industry concern. But regulatory guidance is at least 12 to 18 months away from becoming enforceable standards.

In the interim, the organizations with the lowest exposure are those applying existing security principles - least privilege, zero trust, continuous monitoring - to agent deployments proactively, rather than waiting for regulation to tell them to. Our security-first deployment framework provides the structured approach for implementing these controls.

What Boards Need to Ask

If your board has not been briefed on AI agent security, these are the questions that need answers. How many AI agents are deployed across the organization, and which of them have been reviewed by security? What data can each agent access, and are permissions scoped to the minimum required for each task? Is there logging and monitoring of agent actions, tool calls, and data access patterns? What is the incident response plan if an agent is compromised? And does the organization have visibility into shadow AI usage - employees deploying agents outside of IT-approved channels?