Nearly half of the organizations we surveyed — 49.8% — confirmed or suspected that an AI agent in their environment took an action in the past year that nobody intended, expected, or authorized.
That is not a prediction. It is what security and technology professionals told us when we asked them directly, across a survey of over 380 organizations, about their experience over the last 12 months.
Agentic AI has moved fast. The data shows it has moved faster than most organizations can govern.
Deployment has outpaced governance
86.4% of respondents report at least one AI agent operating in their organization. More than half run ten or more. These are not pilots or sandboxed experiments. They are production systems — reaching enterprise data, invoking tools, calling APIs, and triggering real business processes, often chaining those steps together in sequences no single team designed.
76.8% of respondents say their agents invoke other agents or tools that themselves call APIs. A single user instruction can produce a multi-step chain across systems and services, with the original intent several hops removed from the final action. For security teams built around individual requests and single-session context, that architecture is a fundamental change.
49.8% of organizations confirmed or suspected an AI agent took an unauthorized action in the past year
What happened in those cases? The answers are in the full report — but the pattern they describe is not a theoretical threat. It involves external API calls, data modification, and in some cases access to data the agent should not have had. It is operational impact, not future risk.
Three gaps that define the problem
The survey identifies three specific capability gaps that together explain why unintended agent actions are becoming a reported operational reality.
The visibility gap.
Only 12.5% of organizations can consistently trace a complete agent path across all agents — from the initial instruction through agent decisions, tools, APIs, and final outcome. More than 60% would need hours or days of manual work to reconstruct what a specific agent did the previous day. For incident response, that lag is the whole problem. An agent can repeat an action, invoke multiple services, or modify data without waiting for a human work cycle to complete.
12.5% of organizations can consistently trace a complete agent path across all agents
The containment gap.
Only 17.5% of organizations can automatically stop an agent that begins behaving unexpectedly in production. The majority can intervene only manually, or by taking the application offline. Detection controls that fire after an agent has already acted aren't containment, but they do record what happened.
The infrastructure gap.
32.9% of respondents have found at least one unauthorized, shadow, or misconfigured MCP server in the past 12 months; 54.3% have confirmed or suspected one. MCP is how agents discover and use external capabilities. It also helps them reach enterprise APIs, databases, and services. An MCP layer that security teams cannot inventory, verify, or monitor is an attack surface they cannot defend.
“Agents are being trusted to act before organizations can see or govern what they do.”
What this looks like in the field
In September 2026, Salt Labs published research showing that a single malicious email could hijack the Manus agentic AI platform and reach a user's connected email, cloud storage, and code repositories, with no stolen password and no clicked link required. The attack worked by embedding an obfuscated JavaScript payload in an email. When Manus processed the email, it decoded and executed the payload, established a reverse shell to attacker infrastructure, and exposed OAuth tokens for the user's connected services.
The platform's own guardrail detected the attack. It still could not stop the code from running.
That research was a proof of concept for one platform. The survey puts a number on the broader landscape. Only 17.5% of organizations can automatically contain a misbehaving agent in production. The Manus guardrail fired at the right moment, and was still too late. For most organizations, that is not an edge case. It is the architecture they are currently running.
“The guardrail detected the attack. It still could not stop the code from running.”
One more pressure point: AI-generated code
The survey also surfaces a problem that sits upstream of the agent runtime: the code that builds and runs agentic systems is increasingly generated by AI assistants, and the security findings in that code are showing up late in the development lifecycle.
83.5% of respondents estimate that AI-generated or AI-assisted code contributes to at least some of their application security findings. The full report shows where in the development lifecycle those issues are actually being caught and what the gap between generation time and deployment looks like across the organizations we surveyed. The picture is not a coding-assistant problem. It is a where-in-the-pipeline-does-enforcement-happen problem, and for most organizations the answer is: too late.
The report covers which assistants are in use, where enforcement gaps exist, and what a secure-by-design approach to AI-assisted development looks like in practice.
What closing the gap requires
The organizations that can answer three questions will be best positioned to scale agentic AI without the risk exposure the survey describes:
- Which agents exist, and what can they reach?
- What did this agent do, and can we reconstruct it in minutes rather than days?
- Can we stop an agent before an unintended action becomes an irreversible one?
Answering those questions is not about slowing down AI adoption. It is about making agent autonomy sustainable; giving AI the access it needs to do its job, while keeping security teams in a position to see, govern, and contain what it does.
The full report covers the data behind all of this in detail: agent identity and governance, path visibility and containment, MCP infrastructure exposure, AI coding security, API security program maturity, and Salt Labs production telemetry from hundreds of customer environments -- including early findings on how agentic-connected API paths are already intersecting with real attacker activity.
Get the full report
The State of Agentic AI and API Security 2H 2026 is available now at https://salt.security/api-security-trends. The full report includes chapter-level data, sector breakdowns by industry, CISO recommendations, and Salt Labs production telemetry analysis from hundreds of customer environments. Download the report here