HiddenLayer released its 2026 AI Threat Landscape Report this year, and the headline finding is worth taking at face value: one in eight reported AI security breaches now involves an autonomous agent. That share was negligible two years ago.
The shift reflects how quickly enterprise AI has moved from assistive tools to autonomous systems that take actions, call external APIs, and operate across long time horizons without human review of each step. As the scope of what agents can do has expanded, so has the scope of what a successful attack against one can accomplish.
Five attack categories, not one
The HiddenLayer taxonomy organizes AI threats into five categories. The framing is useful because the mitigations differ substantially across them.
Data poisoning targets the training or fine-tuning process. An attacker corrupts the data the model learns from, embedding biases or backdoor behaviors that appear during inference when specific triggers are present. This is hard to detect post-deployment because the poisoned behavior looks like a model prediction, not an intrusion.
AI supply chain attacks target the model artifacts, libraries, and frameworks that organizations integrate rather than build. A poisoned model on Hugging Face, a malicious update to a popular ML library, or a compromised fine-tuning dataset can deliver backdoored behavior through a trusted distribution channel.
Prompt injection is currently the most operationally active category. Indirect prompt injection, where adversarial instructions are embedded in documents, web pages, emails, or database outputs that the model retrieves, has become the dominant vector. The instruction arrives not from the user but from the environment the model operates in. Production CVEs now exist: Microsoft Copilot (CVSS 9.3), GitHub Copilot (CVSS 9.6), and Cursor IDE (CVSS 9.8).
Model evasion encompasses attacks that manipulate model outputs through carefully crafted inputs, bypassing safety classifiers or extracting information the model was trained not to reveal. Jailbreaking is a subset. Success rates across frontier models remain 50 to 84 percent depending on the number of attempts and the system configuration.
Memory and RAG poisoning is the category that the report flags as the hardest to defend and detect. This is the one that has changed most with the rise of agentic systems.
Why memory injection is the hard problem
Agentic AI systems maintain persistent memory to function across sessions and multi-step tasks. A customer service agent remembers prior interactions. A coding agent accumulates knowledge about a project's codebase. A research agent builds a working context as it gathers information.
Memory injection exploits this persistence. An attacker plants instructions in the agent's memory, either through a document the agent reads, an external API response, or a crafted interaction that the agent logs. The injected instruction is dormant at the time of planting. It activates later, during a legitimate user transaction, when the right trigger condition appears.
The detection problem: standard security models assume the attack and the resulting harm occur close together in time and leave traces in the same session or log stream. Memory injection breaks this assumption. The injection event and the harm event are separated, potentially by hours or days, and the harm event looks like a normal model action because the agent is genuinely acting on its memory.
The HiddenLayer report notes no complete defense exists. Defense in depth is the operational answer: limiting what actions agents can take with persistent memory, treating agent memory as an untrusted data store subject to sanitization, and logging agent actions with enough fidelity to reconstruct the causal chain when something goes wrong.
What this means for enterprise AI deployment
For organizations evaluating or expanding AI deployment, these findings have practical implications:
The attack surface of AI tools is the data they read, not just the user input. Every document, repository, web page, and external API response that an AI assistant or agent processes is a potential injection vector. Security reviews that focus only on user-supplied input will miss the dominant production attack class.
Agentic systems need threat models that account for temporal separation between attack and harm. This is architecturally different from web application security, where the request and response are coupled in time. Logging and monitoring architectures designed for web apps will not surface memory injection without adaptation.
The AI supply chain deserves the same skepticism applied to third-party software packages. A model downloaded from a public registry, a fine-tuned base model from a vendor, or a RAG pipeline that ingests external content all extend the trust perimeter in ways that need to be modeled explicitly.
The productive response
None of this argues against deploying AI. It argues for deploying AI with the same rigor applied to any other piece of infrastructure that touches sensitive systems and data.
Concretely: document what your AI tools access and can act on. Apply least-privilege principles to agent permissions. Treat agent memory and retrieved context as untrusted inputs requiring sanitization. Log agent actions at sufficient granularity to reconstruct what happened if an incident occurs. Apply the NIST AI RMF's GOVERN and MAP tiers before worrying about full MEASURE and MANAGE compliance.
One in eight AI breaches being agentic, when most enterprises have been running agentic systems for less than two years, is a trajectory, not a steady state.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization is building a threat model for agentic AI deployment.