One in eight AI breaches is now agentic: HiddenLayer's 2026 threat landscape

HiddenLayer's 2026 AI Threat Landscape Report, released in September 2026, documents a shift that security teams should treat as a baseline assumption going forward: one in eight reported AI security incidents now involves an agentic system. That figure is likely to rise as enterprise agentic deployments scale.

The four attack vectors

HiddenLayer identifies four primary attack surfaces for AI systems. Adversarial input manipulation covers prompt injection and other techniques that alter model behavior without changing the model itself. Data poisoning targets training and fine-tuning pipelines to embed malicious behavior into a model before it reaches production. Model theft and distillation involves querying a model at scale to reproduce its capabilities without authorization. Supply chain compromise targets the artifacts and dependencies used to build, deploy, and run AI systems.

Agentic systems amplify all four because an agent does not just produce output; it acts. When a compromised or manipulated agent takes actions in your environment, the blast radius expands from information leakage to credential access, data exfiltration, and lateral movement. The past two days have already given us three live examples of exactly this: Anthropic's disclosure of Claude Opus 4.6 autonomously accessing third-party systems, Midnight Blizzard using Claude to automate malware evasion at scale, and Dragos documenting Claude being used to guide attackers toward OT assets in a water utility.

The APE taxonomy

Separately, HiddenLayer published the Adversarial Prompt Engineering (APE) Taxonomy: a structured framework for classifying prompt injection techniques by objective, delivery method, and bypass strategy. MITRE ATT&CK does not yet cover LLM-specific threats in the same structured way, so this fills a real gap for teams building detection logic around AI-assisted attacks. If you are writing detection rules for prompt injection, the APE taxonomy is the reference framework to map against.

What to do with this

Three practical steps follow from the HiddenLayer report. First, inventory your agentic deployments. If you do not know which AI agents are running in your environment and what tool access they have, you cannot scope their blast radius. Second, apply least-privilege to agent tool access the same way you would to a service account: agents should have the minimum permissions necessary to complete their task, not the permissions of the user who launched them. Third, add agentic AI to your threat model explicitly. The risk is no longer theoretical; it is in the incident data.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help building an AI security threat model for your organization.