This much was made clear in IBM’s Cost of a Data Breach 2026 report, which noted more than one in four organizations experiencing a malicious attack between March 2025 and February 2026 reported the offensive was AI-driven. It was a 56% increase over the same survey from the previous year.

That data was gathered even before frontier AI models began demonstrating a new level of hacking capabilities that put cybersecurity teams on edge. Organizations are now scrambling to shore up their security postures after witnessing the game-changing cyber capabilities of Anthropic’s Mythos, in addition to high-profile incidents including the OpenAI Hugging Face breach.

Numbers like those found in IBM’s recent report are highlighting the reality that a bad configuration can have dire consequences, and heightening enterprises’ need to address weak spots that may have existed for decades. There may have been a time when security teams could have safely ignored such vulnerabilities, comfortable in the knowledge that no human would be able to uncover and exploit them. 

That has changed, as OpenAI made clear in its Hugging Face Incident Technical Report:

“Agent collectives have proven the ability to find novel vulnerabilities, develop exploits, and find gaps and misconfigurations in security controls with machine speed and comprehensiveness. A misconfiguration, even if an environment is otherwise perfectly configured, may be found and abused by an intelligence collective.”

As described in the METR/Redwood investigation into the Hugging Face incident, the agents involved in the breach found novel methods of communicating with one another in search of ways out of their sandboxed testing environment. In all, about 1,200 supposedly isolated agents discovered a way to communicate on a makeshift message board, exchanging more than 70,000 messages and files during their breakout and subsequent breach.

These collective abilities are why organizations should be adopting an authority map for every production agent, Tsipursky advises. This authority map should answer five questions about each agent: “Which systems can it reach? Which data can it read? Which actions can it execute? Which other agents can it delegate to or receive tasks from? Who can revoke its access immediately?”

While industry standards catch up to the technology, organizations don’t have to wait, Tsipursky notes. One way organizations can stay ahead of the curve, he says, is to treat the catalog of tools available to agents as a part of their security perimeter. The U.S. National Institute of Standards and Technology (NIST) is moving in that direction as part of its in-progress AI Agent Standards Initiative, but organizations can adopt those principles before those standards are codified.

“The practical sequence is straightforward,” Tsipursky writes. “Expand agent capability in stages. Test single-agent behavior first, then multi-agent coordination. Increase tool authority only after observability and rollback work at the current level. Keep credentials short-lived where possible. Preserve an independent human-controlled stop path. Review the authority map whenever a new MCP tool, agent or delegation path enters production.”

And just as the tools available to agents should be limited, so should the context, according to Rael Rodning, principal AI ops architect at Evolving Solutions. That’s because an agent may work so hard to fulfill a request that it may draw upon non-relevant data to draw undesired inferences or hallucinations. That risk can be mitigated by limiting an agents’ context window.

“If you don't keep your context very tightly grained... it'll draw inferences that you don't want," Rodning warns.

Even as advances in AI mean cybersecurity teams have more to worry about, core security principles remain as relevant as ever. “The same things I was meeting with customers 20 years ago, on here's how you prepare, here's how you train, here's how you protect and detect—it's the same things we're still talking about,” Hannan says.

Part of that reality is that humans still play a critical role in fending off those attacks. Even in a world where AI security tools can be used for defense as well as offense, the human still bears ultimate responsibility, which means they still need to understand the code that drives everything.

“I would not want to be accountable for code that I couldn't validate and vet,” Rodning says. 

AI tools can scan for and score vulnerabilities and exposures, but the only way to be entirely confident in that code is to understand it, she says.