More than three-quarters of organizations have dealt with security incidents involving agentic AI in the past year, according to a new report from IRONSCALES published this month. The study found that 77% of companies discovered an AI agent or tool had acted on instructions or content that was malicious, misleading, or unauthorized in the past 12 months, with 57% confirming such incidents occurred. The findings suggest that as businesses hand over more control to AI agents, attackers are exploiting these tools using familiar social engineering tactics that now target machines instead of people.
The survey collected responses from 501 U.S. IT and cybersecurity professionals working at organizations with 1,000 to 10,000 employees. It revealed that 96% of organizations now deploy AI agents capable of acting on employees' behalf, and four out of five grant those agents access to internal systems. Nearly half—49%—allow agents into email inboxes or messaging platforms, while 30% provide access to finance, billing, or payment systems. Only 19% restrict agents to the public web with no internal access. The most frequently accessed systems include ticketing and helpdesk tools at 67%, cloud storage at 56%, email and messaging at 49%, internal file repositories at 49%, and security tools and logs at 47%. The most common incident types were an AI tool summarizing or acting on a malicious email or message, reported by 42%, and an attacker using an AI tool during a phishing or social engineering attempt, cited by 41%.
"For years, the goal of a phishing email was to fool a person. Today, it only has to fool the agent sitting between that person and their inbox," said Eyal Benishti, CEO of IRONSCALES. The report also highlights a governance gap: while IT serves as the primary approver of AI agents, plugins, and connectors at 78% of organizations, security holds that role at just 6%. Among organizations that experienced an AI-agent-related incident, 39% say an employee granted an AI tool access that security wouldn't have approved. The study found a disconnect between confidence and controls—93% say their incident response plan covers AI agents, 93% say training covers safe AI use, and 84% believe they could identify an AI-driven incident, yet only 52% have formal policies, controls, and incident response processes all in place.
According to the report, the rise of agentic AI creates an opening for attackers because organizations are extending the same trust and permissions to automated agents that they once reserved for human employees, but often without applying equivalent security oversight. The study explains that malicious emails no longer need to trick a person directly—they only need to deceive the AI agent that reads, summarizes, or acts on messages before a human ever sees them. Benishti noted that organizations have given AI agents "the key to their email, files, and even payment systems," and attackers are using traditional tricks to turn those agents against them. For managed service providers and managed security service providers, the findings point to a growing challenge as customers adopt AI agents without the governance frameworks typically applied to human users, creating opportunities to help clients inventory deployed agents, evaluate permissions, establish approval processes, and build AI-specific threats into incident response planning.
The report recommends bringing security into the room when agents are approved and protecting the inbox for agents as well as humans, emphasizing that agentic AI demands the same urgency organizations showed last year with deepfakes. Investment in deepfake defense rose from 37% in 2025 to 48% in 2026, and among organizations that lost money to deepfake-related incidents, the estimated average loss fell roughly 20%, from about $280,000 to around $225,000, while seven-figure losses dropped from 6% to 3%. Yet incidents remain widespread at 84%, and the share calling deepfake defense a top priority slipped from 71% to 60% as agentic AI competes for attention. The bottom line: as AI agents gain more autonomy and access, securing the identities, permissions, and workflows behind those tools becomes critical—and the clock is already ticking. The challenge for security leaders will be maintaining vigilance across multiple AI threat vectors simultaneously, rather than allowing progress in one area to erode as attention shifts to the next emerging risk.