Does that mean a small business should avoid AI agents?

No. The incidents cluster where adoption outran control - agents given broad standing access, no logging, and no off switch. A smaller business that starts with one bounded, read-only, human-approved agent inside its own environment carries far less of that risk than a large enterprise racing dozens of agents into production without oversight.

What is the single most important control for an AI agent?

Least privilege plus a human approval gate on any action that writes, sends or pays. Read-only access by default means a compromised or confused agent can look but not damage; requiring human sign-off on consequential actions removes the most expensive failure modes while keeping the time savings.

What is prompt injection and why does it matter here?

Prompt injection is when hidden instructions inside a document, email or web page trick an agent into doing something it should not - the manipulation-by-untrusted-inputs category that nearly half of breached organizations reported. It matters because an agent reads content the way a person does, so any content it processes is a potential instruction. Read-only defaults and approval gates contain the damage.

88% of companies running AI agents had a security incident in 2026

Q: How common are AI agent security incidents in 2026?

Very common. Gravitee's State of AI Agent Security 2026, a survey of over 900 executives and practitioners, found 88% of organizations running AI agents reported a confirmed or suspected security incident in the past year. AvePoint's State of AI 2026 reported a nearly identical 88.4%, with data leakage (50.1%) and manipulation by untrusted inputs (49.6%) as the most common incident types.

An AI agent security incident is any case where an autonomous agent leaks data, is tricked into a harmful action, or acts outside the boundaries it was given. In 2026 these incidents stopped being rare. Two independent surveys published this summer put the rate at almost the same striking number: roughly 88% of organizations running AI agents had at least one confirmed or suspected incident in the past year. That sounds like a reason to stay away. Read closely, though, and it is the opposite - it is a precise map of what to do differently, and most of it favors a smaller, more careful business over a racing enterprise.

Key takeaways. Two 2026 studies - Gravitee's State of AI Agent Security (900+ respondents) and AvePoint's State of AI - independently found about 88% of agent-running organizations hit a security incident in the last year. The incidents cluster where adoption outran control: broad standing access, no logging, and no way to stop a misbehaving agent. The fix is not to avoid agents - it is to run one bounded agent inside your own environment, read-only by default, with a human approving any action that writes, sends or pays. A smaller company that starts this way carries far less risk than an enterprise deploying dozens of ungoverned agents.

The number that got everyone's attention

The headline is unusually consistent for survey data. Gravitee's State of AI Agent Security 2026, which surveyed more than 900 executives and technical practitioners, found that 88% of organizations running AI agents reported a confirmed or suspected security incident in the past year. Separately, AvePoint's State of AI 2026 reported an almost identical 88.4% experiencing at least one AI agent-related breach, with data leakage (50.1%) and manipulation by malicious or untrusted inputs (49.6%) as the two most common types. When two studies with different samples land within half a percentage point of each other, the signal is real: agents that take actions are being deployed faster than the controls around them, and the gap is where incidents happen.

Why the incidents happen - and who is most exposed

The same Gravitee report explains the mechanism, and it is not a mysterious new class of attack. It is missing basics. In its data, 81% of teams were past the planning phase, yet only 14.4% had full security approval for their agents. More telling for a business owner: 63% of organizations could not enforce purpose limitations on an agent - meaning the agent could reach beyond the job it was given - and 60% could not terminate a misbehaving agent once it started. In other words, most incidents trace back to agents with too much standing access, no audit trail, and no off switch. The organizations most exposed are the ones running many agents at once with none of these guardrails, which is precisely the enterprise pattern we described in AI agent sprawl.

Why a smaller business is actually better positioned

Counterintuitively, the 88% number is easier for a small or traditional company to beat than for a large one. A big enterprise inherited the problem: hundreds of experiments, shadow tools, and agents wired into systems before anyone owned the security question. A smaller business starts from a blank page and can build the controls in from the first agent rather than bolting them on after an incident. That is the whole argument of our guide for security owners: when the agent runs inside your own environment, on your keys, with read-only access by default, the scary survey categories - data leakage, uncontained manipulation - lose most of their teeth. The agent simply cannot reach what it was never granted, and every action it takes is logged and reversible.

What to demand before you turn an agent on

The failure patterns in the data translate directly into a short checklist. You do not need a security team to apply it - you need to make each item a condition of going live, the same discipline that separates the pilots that survive from the ones in the project graveyard.

Read-only by default. The agent can look at your systems but cannot change, send or pay anything until you explicitly grant that specific permission. This alone neutralizes the most expensive incident types.
A human gate on every consequential action. Drafts, not sends. Proposed entries, not silent writes. Anything customer-facing or financial waits for a person to approve - the draft-first pattern from our implementation guide.
It runs in your environment. Your keys, your perimeter, your logs. Data the agent touches does not leave to a third party you cannot audit.
A full audit trail and an off switch. Every action is logged and traceable to a purpose, and you can stop the agent instantly - the two controls 60% of surveyed firms were missing.
One bounded job, not open-ended autonomy. Scope the agent to a single process with a clear start and finish, so "acting outside its boundaries" has almost no room to happen.

The practical read for your business

Treat the 88% as a specification, not a warning label. It tells you exactly which corners the market cut and which ones you will not. The businesses on the wrong side of that number moved fast and governed later; the ones on the right side put least-privilege access, human approval and logging in place before the first agent went live. That is not a heavier way to adopt AI - it is usually a lighter one, because a bounded read-only agent is simpler to build and to trust than an unconstrained one. If you are still weighing whether you even need a custom agent or an off-the-shelf copilot will do, our decision framework is the right place to start, and the security posture above applies either way.

Frequently asked questions

How common are AI agent security incidents in 2026?

Very common - about 88% of organizations running agents reported one in the past year, per both Gravitee's and AvePoint's 2026 surveys. Data leakage and manipulation by untrusted inputs were the most frequent types.

Should a small business avoid AI agents because of this?

No. The incidents cluster where adoption outran control. A smaller business starting with one bounded, read-only, human-approved agent inside its own environment carries far less of that risk.

What is the single most important control?

Least privilege plus a human approval gate on any action that writes, sends or pays. Read-only by default means a confused or compromised agent can look but not damage.

What is prompt injection?

Hidden instructions inside a document, email or web page that trick an agent into acting against your interest - the manipulation category nearly half of breached firms reported. Read-only defaults and approval gates contain it.

88% of companies running AI agents had a security incident last year - what it means for your business