All Incidents
Two Thirds of Companies Had a Cybersecurity Incident Caused by AI Agents in the Last Year. Most Have No Plan to Decommission Them.
BreakingAPR 21, 2026SYSTEMIC FAILURE

Two Thirds of Companies Had a Cybersecurity Incident Caused by AI Agents in the Last Year. Most Have No Plan to Decommission Them.

The Cloud Security Alliance published a study today: 65% of organizations experienced at least one cybersecurity incident caused by AI agents in the past twelve months. Data exposure, operational disruption, financial losses. Unchecked AI agents operating on corporate networks.

The most striking finding: 68% of organizations claim high confidence in their visibility of AI agents on their network. But 82% of those same organizations discovered previously unknown agents in the past year. High confidence. No actual visibility. That gap is the incident.

The majority of organizations have no strategy for decommissioning AI agents. They deploy them. They forget about them. The agents keep running, keep accessing systems, keep taking actions, long after anyone is paying attention.

Two thirds of companies. One year. No oversight. This is not a future risk. It is the current reality documented by the world's leading cloud security research organization.

HOFFICIALHITL Score
HITL Score0/100
Why this matters to youNo jargon — just what it means

When a company brings in a new worker, you'd hope they at least know who's on the payroll and can let them go when the job's done. With AI 'workers' — software helpers that act on their own — many companies can't do either. A major security study found that two out of three companies had a security problem caused by one of these AI helpers in just the past year: data leaking out, systems going down, money lost.

Here's the kicker. Most of these companies were confident they knew exactly which AI helpers were running on their systems — yet most also discovered ones they never knew existed. And the majority have no plan to ever shut them off. They switch them on and forget them, while the helpers keep working, keep reaching into systems, long after anyone's paying attention.

So how does it touch you? Your bank, your doctor's office, your employer are quietly handing tasks to these AI workers — and many honestly don't know how many they've got or how to stop one gone wrong. Your private information sits inside systems run partly by machines nobody's keeping count of. Forgotten doesn't mean harmless. It means unwatched.

🖤 Explained by Babycakes.
Read the full source →
Source: CLOUD SECURITY ALLIANCE / INFOSECURITY MAGAZINE