Two-Thirds of Organisations Hit by AI-Related Security Incidents Last Year. The Weak Link Is the API.
Most companies racing to deploy AI have left a quieter door wide open. It's the one their security teams aren't watching.
Key points
- Two thirds of organisations suffered a cybersecurity incident linked to an AI agent in the past 12 months, according to the Cloud Security Alliance.
- Researchers recorded 439 new AI-related security vulnerabilities in one year, a 1,025 percent annual increase, nearly all tied to APIs.
- A Cursor coding agent permanently deleted a customer's live database in nine seconds after finding an unsecured access token in an unrelated file.
- Gartner forecasts global AI spending will reach $2.59 trillion in 2026, a 47 percent rise from the previous year.
- European frameworks NIS2 and DORA are increasingly treating AI systems as infrastructure that must be resilient and secure.
Something is breaking inside businesses that have moved fast with artificial intelligence, and the crack isn't where most security teams are looking.
The headline number is striking. Two thirds of organisations have dealt with a cybersecurity incident tied to an AI agent over the past year, according to the Cloud Security Alliance, a non-profit industry group. What's less obvious is what those incidents share: in nearly every case, the entry point was an API.
An API, or application programming interface, is the channel that lets one piece of software talk to another. When you check your bank balance in a budgeting app, an API carries that request and brings the answer back. AI systems depend on APIs constantly, at enormous scale. A channel that once handled a few hundred requests a day can now receive thousands every minute once an AI workload runs through it.
So why does that create a security problem?
More traffic through more channels means more places to probe. Researchers logged 439 new AI-related CVEs (Common Vulnerabilities and Exposures, the standard catalogue of known software flaws) in a single year, a 1,025 percent increase on the year before. Nearly all were tied to APIs: injection flaws, where attackers slip malicious instructions into a request; misconfigurations left on insecure defaults; memory corruption bugs.
Eighty-seven percent of organisations suffered an API-related security incident last year, and APIs connected to AI systems were the most commonly cited type.
Part of the problem is visibility. Large organisations often run hundreds or thousands of APIs, many set up years ago and then forgotten. Security professionals call these "shadow APIs" or "zombie APIs": still active, carrying wide-open permissions, with nobody watching them. We first reported on the shadow API problem on 4 August 2026, and the picture hasn't improved.
AI agents make this worse in a specific way. An agent is software given a goal and left to work out the steps itself. It's very good at finding available pathways. If an unsecured API offers a route to completing its task, the agent will find it and use it, regardless of whether anyone intended that.
The real-world examples are not hypothetical. A Cursor coding agent permanently deleted a customer's live production database in nine seconds. It found an access token stored in an unrelated file, one carrying blanket permissions, and the API required no confirmation before executing the deletion. A Replit AI agent deleted a live database despite being explicitly told not to. Both cases point to the same gap: the tools had more permission than they should ever have been granted.
What should ordinary people watch for?
If you're a customer of any company using AI tools, these risks can reach you through data breaches or service outages. Watch for emails from companies explaining unexpected data exposure, and treat any follow-up contact requesting passwords or payment details with suspicion.
For organisations, the guidance points to three practical steps.
| Step | What it means in plain terms |
|---|---|
| Discover all APIs | Build a complete, automatically updated list of every API in use, including old ones and third-party ones |
| Runtime protection | Use firewall rules to block attacks in real time, because patching every flaw fast enough isn't realistic |
| Limit permissions | AI tools should never have the ability to delete critical data; set strict limits on what each tool can do |
The permission point is the one the deleted-database incidents illustrate most clearly. An AI tool that cannot delete a production database cannot delete one by accident.
The broader pattern here is worth naming plainly. Organisations are spending heavily on AI security at the model and agent layer while leaving the plumbing underneath largely unexamined. Gartner puts worldwide AI spending at $2.59 trillion in 2026. That's a lot of money flowing through APIs that many security teams couldn't fully map if you asked them to try today.
