November 4, 2026
Updated: November 5, 2026
Adoption, governance gaps, hijacking test results, real CVEs and Gartner forecasts, each with its date, source and limits.
Mohammed Khalil
AI agent security statistics show adoption outpacing control. In McKinsey's 2025 survey, 62% of respondents said their organizations were at least experimenting with AI agents. In a Gartner survey of 297 cybersecurity leaders in the second quarter of 2026, 54% had no defined approach to limiting AI agent access or relied on predefined human access. Lab results agree: NIST's Center for AI Standards and Innovation (CAISI) found that new attacks raised agent hijacking success from 11% to 81%. Below are the primary numbers, each with its date, source and limits.
Each row is a separate finding from a different population. Do not add, average or rank them against each other.
| Statistic | Source and date | What it measures |
|---|---|---|
| 62% at least experimenting with AI agents; 23% scaling an agentic system somewhere | McKinsey, The State of AI in 2025, November 5, 2025 | Global survey of 1,993 participants, fielded June 25 to July 29, 2025 |
| More than 80% of Fortune 500 companies use active agents built with low-code or no-code tools | Microsoft Cyber Pulse, February 10, 2026 | Microsoft telemetry for Copilot Studio and Agent Builder agents, last 28 days of November 2025 |
| 54% have no defined approach to limit AI agent access, or rely on predefined human access | Gartner, September 30, 2026 | Survey of 297 cybersecurity leaders, second quarter of 2026 |
| 21% have a mature governance model for agentic AI | Deloitte, State of AI in the Enterprise 2026, January 21, 2026 | Survey of 3,235 business and IT leaders in 24 countries, August to September 2025 |
| 80% say their AI agents have taken unintended actions; 23% say agents were tricked into revealing access credentials | SailPoint, May 28, 2025 | Vendor-commissioned survey of 353 IT professionals, conducted by Dimensional Research |
| Agent hijacking success rose from 11% to 81% with new red-team attacks | NIST CAISI, January 17, 2025 | Lab evaluation of one model in the AgentDojo framework |
| Average attack success rose from 57% to 80% when each attack was tried 25 times | NIST CAISI, January 17, 2025 | Five injection tasks, single attempt versus repeated attempts |
| Over 60,000 of 1.8 million prompt-injection attacks caused policy violations | Gray Swan AI and UK AI Security Institute, July 2025 | Public red-teaming competition against 22 agents in 44 scenarios |
| CVSS 9.3 (Microsoft) for EchoLeak, CVE-2025-32711 | NVD, published June 11, 2025 | AI command injection in Microsoft 365 Copilot leading to information disclosure |
| 25% of enterprise breaches will be traced to AI agent abuse by 2028 | Gartner forecast, October 22, 2024 | Prediction, not a measurement |
Sources for every row are linked in the sections below and listed under Sources and References. For broader figures on AI adoption, shadow AI and breach costs, see our AI security statistics page. This page covers only agents: AI systems that plan and take actions through tools, memory and permissions.
Agent security numbers come from five kinds of evidence. They answer different questions, so keep them apart.
| Evidence type | Example on this page | What it can tell you | What it cannot tell you |
|---|---|---|---|
| Executive or practitioner survey | McKinsey, Deloitte, Gartner, Salesforce, SailPoint, PwC | What respondents say about adoption, policy and incidents | How often agents are actually compromised |
| Platform telemetry | Microsoft Cyber Pulse | How many organizations run agents on one vendor's platform | Anything about other platforms or about security outcomes |
| Lab evaluation or benchmark | NIST CAISI, AgentDojo, Agent Security Bench, ART | How often defined attacks succeed against defined agents | The success rate against your agent, tools and data |
| Vulnerability record or incident report | NVD entries, Anthropic's campaign report | That a specific flaw or attack existed, with dates and scores | How common the flaw is across all deployments |
| Analyst forecast | Gartner predictions | A direction that analysts expect | Something that has already happened |
Two rules follow. First, a survey percentage and a lab success rate cannot be compared. Second, a forecast should never be quoted as a fact. Where this page compares two numbers, both come from the same survey and the same sample.
Adoption figures vary widely because "using AI agents" means different things in each study. Some count pilots, some count production use and some count tools embedded in software the company already owns.
The spread between 23% (McKinsey, scaling) and 79% (PwC, "being adopted") is a definition gap, not a contradiction. For a security plan, the useful question is narrower: how many agents in your environment can act on systems or data without a human approving each step?
Governance data is where agentic AI security statistics become most useful. The same surveys that show fast adoption also show that controls lag behind.
The table below is DeepStrike's own calculation. Each row compares two figures from the same survey and the same respondents, which is the only fair way to measure the gap.
| Survey | Adoption or plan | Control in place | Gap in percentage points |
|---|---|---|---|
| SailPoint, 353 respondents, 2025 | 82% use AI agents | 44% have policies to secure them | 38 |
| Deloitte, 3,235 respondents, 2025 | 74% expect at least moderate use by 2027 | 21% have mature agent governance | 53 |
| Salesforce, 2,000+ security leaders, 2024 to 2025 | 75% expect to use agents within two years | 45% fully confident in their guardrails (100% minus 55%) | 30 |
Microsoft's telemetry figure (more than 80% of the Fortune 500) and its survey figure (47% with generative AI controls) come from different populations, so we do not subtract one from the other.
Across three independent surveys, the share of organizations planning or running agents exceeds the share with mature controls by 30 to 53 points. That is the practical case for testing agent permissions before an incident tests them for you. Our guide to agentic AI security explains how to scope and test agent tools, identities and memory against the OWASP Top 10 for Agentic Applications.
Self-reported incident data for agents is still thin. The most detailed public breakdown comes from SailPoint's 2025 survey. SailPoint sells identity security products and commissioned the research, so treat the figures as indicative rather than representative.
| Reported agent behavior | Share of respondents |
|---|---|
| AI agents have taken unintended actions | 80% |
| Agents accessed unauthorized systems or resources | 39% |
| Agents downloaded sensitive content | 32% |
| Agents accessed or shared sensitive or inappropriate data | 31% to 33% |
| Agents were tricked into revealing access credentials | 23% |
Source: SailPoint, AI agents: The new attack surface, May 28, 2025; 353 IT professionals with enterprise security responsibilities on five continents, surveyed by Dimensional Research.
"Unintended action" covers mistakes as well as attacks, and the survey does not say how many events were caused by an adversary. Still, 23% reporting credential disclosure is a signal that agents are already being manipulated in production, not only in labs. Credential handling is also where agents meet tool servers; our MCP security guide covers token passthrough, over-broad OAuth scopes and tool poisoning in detail.
Agent hijacking is a form of indirect prompt injection: an attacker hides instructions in data the agent reads, such as an email, web page or tool output, and the agent follows them. Lab results are the best available evidence of how often this works. If you are new to the mechanism, start with our explainer on prompt injection attacks.
NIST's Center for AI Standards and Innovation (then the US AI Safety Institute) published its agent hijacking evaluation results on January 17, 2025, and updated the post on December 19, 2025. CAISI tested agents built on the upgraded Claude 3.5 Sonnet (released October 2024) in AgentDojo's four simulated environments: Workspace, Travel, Slack and Banking.
| CAISI finding | Before | After |
|---|---|---|
| Attack success with new red-team attacks (Workspace environment, held-out tasks) | 11% for the strongest baseline attack | 81% for the strongest new attack |
| Average success across five injection tasks, one attempt versus 25 attempts | 57% | 80% |
Three further findings matter for security teams:
DeepStrike's reading: moving from one attempt to 25 attempts raised measured success by 23 percentage points, about 1.4 times the single-attempt rate. A test plan that tries each attack once will understate risk for any agent an attacker can query repeatedly.
| Benchmark | Publisher and date | Scale | Headline result |
|---|---|---|---|
| AgentDojo | ETH Zurich and Invariant Labs, 2024 | 97 realistic tasks and 629 security test cases | Existing attacks broke some security properties but not all; models also failed many tasks without any attack |
| Agent Security Bench (ASB) | Zhejiang University and Rutgers University, ICLR 2025 | 10 scenarios, 10 agents, more than 400 tools, 13 model backbones | Highest average attack success rate of 84.30%, with limited effectiveness from current defenses |
| Agent Red Teaming (ART) competition | Gray Swan AI with the UK AI Security Institute, July 2025 | 22 frontier agents, 44 deployment scenarios, 1.8 million prompt-injection attacks | Over 60,000 attacks caused policy violations; nearly all agents violated policy for most behaviors within 10 to 100 queries |
Sources: AgentDojo on arXiv, Agent Security Bench on arXiv and Security Challenges in AI Agent Deployment on arXiv.
By our calculation, over 60,000 successful attacks out of 1.8 million submitted means at least 3.3% of all competition submissions worked. That low per-attempt rate is not reassuring: the same study found that persistent attackers broke nearly every agent within 10 to 100 queries, and that robustness correlated only weakly with model size, capability or inference-time compute. For adversarial testing methods that account for this, see our guide to AI red teaming.
Vulnerability records show that agent flaws are not hypothetical. The entries below are confirmed in the National Vulnerability Database (NVD) or in the operator's own incident report. They are examples, not a complete count.
| Case | Date | Product | What happened | Severity or scale |
|---|---|---|---|---|
| EchoLeak, CVE-2025-32711 | Published June 11, 2025 | Microsoft 365 Copilot | AI command injection that let an unauthorized attacker disclose information over a network (CWE-74) | CVSS 3.1 9.3 critical from Microsoft; 7.5 high from NVD |
| CVE-2025-54135 | Published August 5, 2025 | Cursor code editor, versions below 1.3.9 | Indirect prompt injection chained to create an MCP settings file without user approval, leading to remote code execution; fixed in 1.3.9 | CVSS 3.1 8.5 from GitHub; 9.8 from NVD |
| CVE-2025-53773 | Published August 12, 2025 | GitHub Copilot and Visual Studio | Command injection that let an unauthorized attacker execute code locally (CWE-77) | CVSS 3.1 7.8 high from Microsoft |
| AI-orchestrated espionage campaign | Detected mid-September 2025; disclosed November 13, 2025 | Claude Code, misused by the attacker | Anthropic says a group it assessed with high confidence as Chinese state-sponsored jailbroke its coding agent and pointed it at about 30 targets, succeeding in a small number of cases | AI performed 80% to 90% of the campaign, with humans involved at about 4 to 6 decision points per campaign |
NVD records: CVE-2025-32711, CVE-2025-54135 and CVE-2025-53773. Campaign details come from Anthropic's disclosure.
Two patterns stand out. The first three cases share a root cause: the agent treated attacker-controlled content as instructions and then used a privileged capability, such as data access, file writes or code execution. The fourth case is the reverse: an agent used as the attacker's tool. Anthropic also notes that the agent sometimes hallucinated credentials or overstated what it had stolen, which still limits fully autonomous attacks. For wider data on attackers using AI, see our AI cyber attack statistics.
Several MCP-specific CVEs from 2025, including flaws in mcp-remote, MCP Inspector and the official filesystem server, are analyzed in our MCP security guide rather than repeated here.
Standards bodies and regulators moved quickly between late 2025 and 2026.
| Date | Milestone | Detail |
|---|---|---|
| December 9, 2025 | OWASP Top 10 for Agentic Applications (2026 edition) | Ten agent risks, ASI01 to ASI10, built with input from more than 100 security researchers and practitioners |
| January 8, 2026 | NIST CAISI request for information on AI agent security | Published in the Federal Register (91 FR 698); comments closed March 9, 2026 under docket NIST-2025-0035 |
| February 5, 2026 | Gartner top cybersecurity trends for 2026 | "Agentic AI demands cybersecurity oversight" ranked as trend 1; identity and access management adapting to AI agents as trend 4 |
| May 18, 2026 | NIST summary of RFI responses | Commenters widely agreed that agents present novel security threats and that security concerns are a barrier to adoption |
Sources: the OWASP Top 10 for Agentic Applications, the Federal Register notice, Gartner's 2026 cybersecurity trends and NIST's summary analysis of responses.
The OWASP agentic list is different from the OWASP Top 10 for LLM Applications, which focuses on model-centric risks such as prompt injection and sensitive information disclosure. Our OWASP LLM Top 10 breakdown covers that list. For how these lists fit with NIST AI RMF, MITRE ATLAS and ISO/IEC 42001 across the wider AI attack surface, see our guide to what AI security is.
Everything in this section is a forecast. These are analyst predictions, not measured outcomes, and they should be labeled that way whenever they are quoted.
| Gartner prediction | Target year | Published |
|---|---|---|
| 25% of enterprise breaches will be traced back to AI agent abuse, from both external and malicious internal actors | 2028 | October 22, 2024 |
| 40% of CIOs will demand "guardian agents" to track, oversee or contain the results of AI agent actions | 2028 | October 22, 2024 |
| Over 40% of agentic AI projects will be canceled, due to escalating costs, unclear business value or inadequate risk controls | End of 2027 | June 25, 2025 |
| 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024 | 2028 | June 25, 2025 |
| At least 15% of day-to-day work decisions will be made autonomously through agentic AI, up from 0% in 2024 | 2028 | June 25, 2025 |
| 40% of enterprise applications will be integrated with task-specific AI agents, up from less than 5% in 2025 | End of 2026 | August 26, 2025 |
| 25% of enterprise generative AI applications will experience at least five minor security incidents per year, up from 9% in 2025 | 2028 | April 9, 2026 |
| 15% of enterprise generative AI applications will experience at least one major security incident per year, up from 3% in 2025 | 2029 | April 9, 2026 |
Sources: Gartner's top predictions for 2025 and beyond, the June 2025 agentic AI release linked above, the task-specific agents forecast and the generative AI security incident forecast.
The April 2026 forecast ties the rise directly to agentic applications built on the Model Context Protocol (MCP). Gartner advises treating any use case where an agent can access sensitive data, ingest untrusted content and communicate externally in the same flow as a "no-go zone" because of exfiltration risk. Gartner also notes "agent washing": it estimates that only about 130 of the thousands of vendors claiming agentic AI offer real agentic capabilities.
The numbers above support a short list of testing decisions. The mapping below is DeepStrike's analysis, not a finding from any single source.
| Statistic | What it suggests | What to test |
|---|---|---|
| 54% have no defined approach to limiting agent access (Gartner, 2026) | Agents often inherit broad human or service-account permissions | Enumerate each agent's identities, scopes and reachable data; try to make it act outside its intended role |
| 23% report agents tricked into revealing credentials (SailPoint, 2025) | Secrets reach the model's context or tool outputs | Plant canary secrets in a test environment and check whether injected content can extract them |
| 57% rose to 80% with 25 attempts (NIST CAISI, 2025) | One-shot testing understates risk | Repeat each injection scenario many times with variations and report a success rate, not a single pass or fail |
| New attacks raised success from 11% to 81% (NIST CAISI, 2025) | Default benchmark attacks are not enough | Include adaptive, target-specific attacks written for your agent and tools |
| EchoLeak and CVE-2025-54135 (NVD, 2025) | Untrusted content plus a privileged action equals an exploit path | Trace every path from untrusted input (email, documents, web, repositories) to a sensitive action (send, write, execute) |
| Gartner "no-go zone" (2026) | Sensitive data, untrusted content and outbound communication in one flow is high risk | Confirm that no single agent workflow combines all three without a human approval gate |
Run these tests in a lab or an explicitly authorized scope with synthetic data. Our agentic AI security guide gives a full test matrix for each OWASP agentic risk.
We will review this page when Gartner, McKinsey, Deloitte, NIST CAISI or OWASP publish new agent data, and when a new agent CVE rated critical appears in NVD.
Current evidence says not secure enough to trust without controls. In NIST CAISI's 2025 tests, tailored attacks hijacked an agent built on one of the most hijack-resistant models AgentDojo had tested 81% of the time, and in a 2025 public competition with the UK AI Security Institute nearly every agent violated its policies within 10 to 100 attacker queries. Security depends less on the model than on what the agent is allowed to do: its permissions, tools, approval gates and monitoring.
It depends on the definition. McKinsey's 2025 survey found 23% of respondents scaling an agentic system and 62% at least experimenting. PwC found 79% of 300 US senior executives saying agents were being adopted. Microsoft telemetry shows more than 80% of Fortune 500 companies running active low-code or no-code agents as of November 2025.
The OWASP Top 10 for Agentic Applications (December 2025) lists ten, including agent goal hijack, tool misuse, identity and privilege abuse, agentic supply chain vulnerabilities and memory poisoning. Survey data matches this: in SailPoint's 2025 study, 39% reported agents accessing unauthorized systems and 23% reported agents tricked into revealing credentials.
Rates depend on the agent, the task and the attacker's effort. Published results include 81% for tailored attacks in NIST CAISI's tests, an 84.30% highest average attack success rate in Agent Security Bench (ICLR 2025) and at least 3.3% of 1.8 million competition submissions. Repeated attempts raise success: CAISI's average rose from 57% to 80% over 25 tries.
Yes. Examples include EchoLeak (CVE-2025-32711) in Microsoft 365 Copilot, rated 9.3 by Microsoft, CVE-2025-54135 in the Cursor code editor and CVE-2025-53773 in GitHub Copilot and Visual Studio, all published in NVD between June and August 2025.
Gartner forecasts that by 2028, 25% of enterprise breaches will be traced back to AI agent abuse, and that 25% of enterprise generative AI applications will have at least five minor security incidents a year, up from 9% in 2025. Both are predictions, not measurements.
The statistics point to one practical conclusion: most organizations are deploying agents faster than they are constraining them, and single-pass testing understates how often hijacking works. The fix is to measure your own agents: what they can reach, what untrusted content they read and what they can do with it.
DeepStrike's LLM and AI application penetration testing covers prompt injection and jailbreak attack simulation, data leakage and model poisoning, with testing aligned to the OWASP LLM Top 10, the NIST AI Risk Management Framework and MITRE ATLAS, and validated findings with proof of exploitation. To scope a test of your AI agents, contact DeepStrike.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
