Nobody has to break into your systems anymore. They just have to write something your agent was already going to read — a README, a support ticket, a calendar invite, a resume. The agent reads it, follows it, and reports back a normal-looking answer while it does.
Google's own security team has been scanning the web for exactly this, and the trend is not flat. Repeating the same scans across archive snapshots, they found a relative increase of 32% in malicious prompt-injection content between November 2025 and February 2026. The web didn't get safer for agents. It got more adversarial, on a measurable curve.
The rule that fits in one sentence
Meta's security team published the cleanest guardrail we've seen for this: an agent should hold no more than two of three properties at once, within a single session — processing untrusted input, accessing sensitive systems or data, and taking action or communicating externally. Hold all three, unrestricted, and you don't have an agent. You have an exfiltration channel that hasn't found its trigger yet. Meta's own framework is explicit about the consequence: an agent that needs all three shouldn't run autonomously. It needs a human step, full stop.
- Can it read untrusted content? A README, a webpage, an inbound email, a support ticket. If yes, that's one.
- Can it touch sensitive systems or data? Internal databases, credentials, customer records, financial systems. If yes, that's two.
- Can it act or communicate externally on its own? Send email, execute a transaction, push code, call another system. If yes — and it already had the other two — it needs a human step before it goes further, not after.
What's actually happening at most companies right now
A 2026 Cloud Security Alliance study found 47% of organizations experienced a security incident involving an AI agent in the past year, and 53% have had an agent exceed its intended permissions. Only 8% say their agents have never exceeded what they were authorized to do.
Separate research from Cequence and EMA found the confidence gap sitting underneath those numbers: 94% of enterprise IT and security leaders are confident their AI agents don't have more access than they need. Only 33% actually provision agents with least-privilege access to back that confidence up. The other two-thirds are running on standing permissions that get reviewed periodically, rarely, or never.
confident their agents aren't over-provisioned, vs. actually enforcing least-privilege access
of organizations had a security incident involving an AI agent in the past year
of abandoned agent pilots were left with live credentials still in place
Before an agent goes to production
Every engineering leader shipping an agent should be able to answer one question: if this agent does something it shouldn't, can you prove what happened, why, and who authorized it? If the answer is no, the agent isn't ready — regardless of how good the demo looked.
We spent the last two years arguing about which model to standardize on. The harder question was never which model. It's what you let it read, and what you let it do about it.
Agent security isn't a niche concern for the security team to handle later. It's the gatekeeper standing between a good demo and something enterprise buyers will actually trust.