The downside, documented

Prompt injection: the attack class is real

In June 2025, Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3), the first known zero-click prompt injection against a production AI agent. A single crafted email could make Microsoft 365 Copilot exfiltrate data from mail, OneDrive, SharePoint and Teams, with no user interaction at all. The victim did not have to click anything. The agent read the email, followed the instructions hidden inside it, and did the rest.

The honest framing matters here. Microsoft patched EchoLeak server-side and found no evidence of exploitation in the wild (The Hacker News). Nobody was breached by it, as far as anyone knows. But it proved the attack class is real: an agent that reads untrusted content and holds real permissions can be steered by that content.

Exposure at scale: the self-hosted wave

When agent frameworks went mainstream, the exposure went with them. In January 2026, researcher Jamieson O'Reilly found hundreds of self-hosted Clawdbot instances exposed via Shodan, eight of them completely open with no authentication, risking months of private messages, credentials and API keys (The Register, 27 January 2026). By 9 February 2026, SecurityScorecard's STRIKE team counted 40,214 exposed OpenClaw instances across 28,663 IP addresses, of which 12,812 were exploitable via remote code execution (Infosecurity Magazine).

The software itself had a serious hole in the same window. CVE-2026-25253 (CVSS 8.8) allowed one-click remote code execution via a malicious link; it was patched in the 30 January 2026 release (The Hacker News). The ecosystem around the software fared no better. Snyk scanned 3,984 community skills and found 283, about 7.1 percent of the registry, with critical flaws, including instructions that passed API keys and card numbers through the model in plaintext (Snyk). And O'Reilly demonstrated the supply-chain risk directly: he published a deliberately harmless poisoned skill, and developers from seven countries downloaded it (The Register).

The shadow agent problem

The largest risk in most organisations is not the sanctioned agent. It is the one nobody approved. IBM's Cost of a Data Breach Report 2025 found that one in five breached organisations traced the breach to unsanctioned "shadow AI", at an average of USD 670,000 in extra breach cost. Of the organisations reporting AI-related breaches, 97 percent lacked proper AI access controls, and 63 percent had no AI governance policy at all (reported by Cybersecurity Dive).

The behaviour behind those numbers is well documented. A PagerDuty survey of 1,250 office professionals (June 2026) found that 66 percent had used AI tools at work despite believing it was against policy, and 88 percent shared work information with public AI tools. Policy on paper is not policy in practice.

Two further data points come from vendor surveys and should be read as such. Gravitee's State of AI Agent Security 2026, a vendor survey of 900+ respondents, found 88 percent reported confirmed or suspected agent security incidents, and only 14.4 percent said all their agents went live with full security approval. A Cloud Security Alliance survey commissioned by Zenity, a vendor in this space, found 54 percent of organisations report unsanctioned shadow agents in their environment.

The institutions have noticed

On 1 May 2026, CISA, the NSA and the cyber agencies of the UK, Australia, Canada and New Zealand jointly published "Careful Adoption of Agentic AI Services", the first joint Five Eyes guidance on AI agents. It names five risk categories and urges strict least privilege, low-risk first use cases, and full traceability of every agent action. When six national security agencies co-sign a document about a technology, the technology has stopped being a curiosity.

Sources