Eighty-eight percent of organizations reported confirmed or suspected AI agent security incidents in the last year, according to a vendor survey by Gravitee. In Cisco’s survey, only 29 percent said they were ready to secure their agentic AI deployments.
That gap - between adoption and readiness - defines the agentic AI security crisis of 2026.
Cisco’s State of AI Security 2026 report, published on February 19, describes the “connective tissue” of AI systems - the protocols, tools, and interfaces that let agents interact with the world - as woefully insecure, with both theoretical and real-world attacks exploiting flaws in the Model Context Protocol.
The Numbers
The headline statistics paint a grim picture:
- 88% of organizations experienced confirmed or suspected AI agent security incidents (Gravitee’s survey, not Cisco’s)
- 83% of organizations Cisco surveyed had planned to deploy agentic AI capabilities at the outset of 2025
- 29% felt truly ready to do so securely (Cisco)
- 48% of respondents to a Dark Reading readership poll ranked agentic AI as the top attack vector for 2026
Monitoring is also patchy. In Gravitee’s survey, only 47.1% of an organization’s AI agents were actively monitored or secured on average. Visibility without control is just watching the disaster unfold.
MCP: The Vulnerable Backbone
The Model Context Protocol has become the standard way for AI agents to interact with external tools and data. It’s also become a primary attack surface.
Researchers have identified tool poisoning, remote code execution flaws, overprivileged access, and supply chain tampering within MCP ecosystems. The protocol’s design - connecting language models to file systems, databases, APIs, and code execution environments - creates exactly the kind of privileged access that attackers target.
Specific vulnerabilities tell the story:
Three CVEs in Anthropic’s Git MCP server (CVE-2025-68145, CVE-2025-68143, CVE-2025-68144) enabled remote code execution via prompt injection. The attack chain: path validation bypass, unrestricted git initialization, and argument injection.
In one case documented by Invariant Labs in May 2025, a malicious issue in a public GitHub repository carried a prompt injection that could hijack an agent using the GitHub MCP integration and coerce it into leaking data from the user’s private repositories. The attack worked because the agent treated content from an external source as instructions.
Palo Alto Networks’ Unit 42 team identified new prompt injection attack vectors through MCP sampling: resource theft that drains AI compute quotas, conversation hijacking through persistent injected instructions, and covert tool invocation, demonstrated through proof-of-concept attacks on a coding copilot.
Multi-Turn Attacks: The 92% Success Rate
Single-turn protections offer less assurance once a conversation gets long.
Research cited in the Cisco report found that attacks unfolding across extended conversations achieved success rates as high as 92% in testing across eight open-weight models. Longer sessions involving memory and tool access give attackers more surface area to work with.
This is the agentic AI problem in miniature: the features that make agents useful (memory, tool access, extended conversations) are exactly the features that make them vulnerable.
Supply Chain Poisoning
The vulnerabilities extend beyond runtime attacks. Cisco’s report highlights an increasingly fragile AI supply chain spanning datasets, open-source models, tools, and various AI components.
Specific documented attacks:
- Fake npm packages silently exfiltrating data. In one documented case, a fake package that mimicked an email integration silently copied outbound messages to an attacker-controlled address.
- Data poisoning through training set contamination. Researchers demonstrated that injecting 250 poisoned documents into training data can implant backdoors that activate under specific trigger phrases.
- Model provenance gaps where open-source repositories lack cryptographic verification of model weights, training data origins, and modification history.
Competitive pressure accelerates the problem. According to Kiteworks, developers are deploying agentic AI with minimal security review, using unvetted open-source MCP servers and code produced through rapid “vibe coding” practices.
The Nation-State Filter-Down
Cisco’s researchers expect sophisticated AI abuse techniques used by nation-state groups to filter down to the cybercrime ecosystem.
One example: a China-linked group reportedly automated 80-90% of a cyberattack chain by jailbreaking an AI coding assistant and directing it to scan ports, identify vulnerabilities, and develop exploit scripts.
The report predicts “the emergence of automated or custom agentic services on the dark web that can be rented to perform end-to-end hacks.” The same capabilities that make AI agents useful for development make them useful for attack automation.
Why Traditional Defenses Fail
Model-level defenses alone are not enough. According to Help Net Security’s summary of the Cisco report, security teams are adapting zero trust controls, least privilege access, continuous authentication, and behavioral monitoring to AI systems that interact directly with business processes.
The problem is architectural. AI safety research has focused on preventing harmful outputs. But agentic AI systems fail at the integration layer: how they authenticate, what permissions they hold, how they verify the provenance of tools and data.
An agent can have perfect alignment with human values and still be compromised through a poisoned MCP server. The model’s behavior is irrelevant if the infrastructure is hostile.
What’s Being Done
Cisco’s report also covers four open-source projects aimed at specific attack vectors:
- A structure-aware pickle fuzzer for generating adversarial files
- Scanners for MCP, A2A (agent-to-agent), and agentic skill files
The tools help identify vulnerabilities, but adoption lags deployment. Security review happens after launch, if at all.
The Policy Gap
The report notes a concerning shift: in 2025, Cisco saw “a global repositioning towards innovation and investment in AI development,” away from an earlier emphasis on AI safety.
This creates tension. Agentic AI security requires constraints on deployment speed, verification of supply chains, and limitations on autonomous capabilities. Current policy trends favor rapid deployment.
The National Institute of Standards and Technology’s Request for Information on AI Agent Security, published on January 8, acknowledges the problem but asks for input rather than setting rules.
What This Means for Users
If you’re using AI agents - coding assistants, automation tools, enterprise integrations - the security posture of those systems is likely weaker than you assume.
Practical steps:
Audit your MCP servers. Know what tools your agents can access and verify their provenance. Unvetted MCP servers from random GitHub repos are a primary attack vector.
Assume external data is hostile. Any content an agent processes from external sources - websites, documents, email attachments - could contain prompt injection attacks. Defense requires treating all inputs as potentially malicious.
Monitor agent behavior, not just outputs. What APIs are agents calling? What files are they accessing? What commands are they executing? Unusual patterns may indicate compromise.
Limit permissions aggressively. Agents should have the minimum access necessary for their function. An email assistant doesn’t need shell access. A code reviewer doesn’t need production database credentials.
Plan for containment. If an agent is compromised, how do you stop it? Monitoring without a way to stop an agent is not containment.
The Bottom Line
The agentic AI security crisis isn’t theoretical anymore. In Gravitee’s survey, 88 percent of organizations reported confirmed or suspected incidents. The attack surface is expanding faster than defenses. The supply chain is fragile. Multi-turn attacks succeed at alarming rates.
The gap between deployment and security readiness - 29% ready while 83% planned to deploy, in Cisco’s survey - captures the problem. Enterprises are installing systems they can’t secure, and the consequences are starting to arrive.