What the numbers say
HiddenLayer surveyed 250 IT and security leaders for its 2026 AI Threat Landscape Report. The headline finding: agentic AI systems now account for one in eight AI-related security breaches. The follow-on finding is more troubling. Roughly one-third of organizations surveyed cannot determine whether they have experienced an agentic AI breach at all.
The detection gap
Most AI security controls are built around the model boundary: content filters, system prompt locks, and output classifiers. What they do not cover is execution-time behavior. When an agent makes a tool call, retrieves a document, invokes a subprocess, or hands off to a sub-agent, that activity is largely unobserved. The HiddenLayer report characterizes this as a structural gap: organizations have instrumented the model, not the workflow.
Public model repositories as a supply chain risk
The most cited breach source in the report (35%) is malware embedded in publicly available model repositories. Teams pull model weights, deploy them without scanning for embedded malicious code, and create a foothold inside the AI inference stack. The uncomfortable data point: 93% of respondents continue to use public repositories for model development, despite knowing the risk. This is the same dynamic as using unvetted open-source packages, applied to a new surface with higher execution privileges.
Prompt injection at 84% success rates
Running alongside the HiddenLayer data, OWASP's 2026 LLM Security Report documents a 340% year-over-year increase in prompt injection attacks, with production exploits against agentic systems achieving an 84% success rate. Indirect prompt injection, where attacker instructions are embedded in documents or web pages the agent retrieves, is the dominant vector. The model processes system instructions and retrieved content in the same token stream and cannot reliably distinguish between them. Security teams should treat indirect injection as an assumed-compromise condition, not a defense-in-depth edge case.
What actually helps
The controls that work are architectural, not model-level. Treat every external data source an agent reads as untrusted input. Require human approval for tool calls that write, delete, send, or execute. Log every agent step at the action level, not just model input and output. Validate retrieval source provenance before content reaches the model. These are standard software engineering disciplines applied to the agentic stack. The technology is new; the attack surface categories are not.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are building security architecture for agentic AI systems and want a second opinion.