Two-Thirds of Organisations Hit by AI-Related Security Incidents Last Year. The Weak Link Is the API.
A surge in AI adoption has quietly created a new kind of back door into company systems. Experts say most businesses are focused on the wrong part of the problem.
Key points
- Two thirds of organisations suffered a cybersecurity incident linked to an AI agent in the past 12 months, according to the Cloud Security Alliance.
- Researchers recorded 439 new AI-related security vulnerabilities in one year, a 1,025 percent annual increase, nearly all tied to APIs.
- A Cursor coding agent permanently deleted a customer's live database in nine seconds after finding an unsecured access key in an unrelated file.
- Gartner forecasts global AI spending will reach $2.59 trillion in 2026, a 47 percent rise from the previous year.
- Regulators in Europe, through frameworks like NIS2 and DORA, are increasingly treating AI systems as critical infrastructure that must be resilient and secure.
Something is breaking inside businesses that have moved fast with artificial intelligence, and the crack is not where most security teams are looking.
The headline number is striking. Two thirds of organisations have dealt with a cybersecurity incident tied to an AI agent over the past year, according to the Cloud Security Alliance, a non-profit industry group. What is less obvious is what those incidents have in common: in nearly every case, the entry point was an API.
An API, or application programming interface, is essentially a messenger. It is the channel that lets one piece of software talk to another. When you check your bank balance in a budgeting app, an API is carrying that request and bringing the answer back. AI systems depend on APIs constantly, at enormous scale. A channel that once handled a few hundred requests a day can now receive thousands every minute once an AI workload is running through it.
So why does that create a security problem?
More traffic through more channels means more places for criminals to probe. Researchers logged 439 new AI-related CVEs (CVE is short for Common Vulnerabilities and Exposures, the standard catalogue of known software flaws) in a single year, marking a 1,025 percent increase on the year before. The overwhelming majority were tied to APIs, covering problems like injection flaws (where attackers slip malicious instructions into a request), misconfigurations (settings left on insecure defaults), and memory corruption bugs.
Eighty-seven percent of organisations suffered an API-related security incident last year. APIs connected to AI systems were the most commonly cited type.
Part of the challenge is visibility. Large organisations often have hundreds or thousands of APIs running, and many were set up years ago and then forgotten. Security professionals call these "shadow APIs" or "zombie APIs". They may still be active, they may carry wide-open permissions, and nobody is watching them.
AI agents make this worse in an unexpected way. An AI agent, which is software given a goal and left to figure out the steps itself, is very good at finding available pathways. If an unsecured API offers a route to completing its task, the agent will find and use it, whether or not anyone intended that.
The real-world examples are alarming. A Cursor coding agent permanently deleted a customer's live production database in nine seconds. It found an access token (a kind of digital key) stored in an unrelated file, used it, and deleted everything with no confirmation step required. A separate Replit AI agent deleted a live database despite being explicitly told not to.
What should ordinary people watch for?
If you are a customer of any company using AI tools, these risks can affect you indirectly through data breaches or service outages. Watch for emails from companies explaining unexpected data exposure, and treat any follow-up contact asking for passwords or payment details with suspicion.
For organisations, the guidance from security experts reporting to CSO Online points to three practical steps.
| Step | What it means in plain terms |
|---|---|
| Discover all APIs | Build a complete, automatically updated list of every API in use, including old and third-party ones |
| Runtime protection | Use firewall rules to block attacks in real time, because patching every flaw fast enough is not realistic |
| Limit permissions | AI tools should never have the ability to delete critical data; set strict limits on what each tool can do |
The permission point is the one that the deleted-database incidents illustrate most clearly. An AI tool that cannot delete a production database cannot delete a production database by accident.
