The biggest threat to your AI agent rollout is not hallucination. It is the fact that 73% of production AI deployments were hit by prompt injection in 2025, and only 29% of the organizations running those agents say they are prepared to secure them, according to Zylos AI's 2026 research on agentic AI security.
That gap matters more with every agent you connect to a real system. A chatbot that gets tricked into saying something odd is embarrassing. An agent that gets tricked into the same thing while holding a database credential, a browser session, or shell access is a breach. The shift from conversational AI to agentic AI has not just added capability. It has widened the blast radius of a single bad instruction by orders of magnitude.
| AI agent security metric (2025-2026) | Figure |
|---|---|
| Production deployments hit by prompt injection | 73% |
| Organizations prepared to secure agent deployments | 29% |
| Rise in malicious injection payloads, Nov 2025-Feb 2026 | 32% |
| Attack traffic shifted to MCP endpoint reconnaissance by Jan 2026 | 60% |
Why agents are a bigger target than chatbots
A conventional chatbot with no tool access has a contained failure mode: the worst outcome is bad text. An agent wired into code execution, file systems, authenticated APIs, browser automation, and persistent memory is a different threat model entirely. Each of those capabilities is an independent lateral-movement path. Chain them together and a single injected instruction can exfiltrate credentials, corrupt stored memory, or spawn additional agents, all inside the agent's normal operating envelope, per Zylos AI's survey of the current attack surface.
Google's threat intelligence team recorded a 32% increase in malicious prompt injection payloads embedded in ordinary web content between November 2025 and February 2026. GreyNoise honeypot data logged 91,403 attack sessions targeting exposed LLM endpoints over roughly the same window, with 60% of that traffic shifting specifically toward reconnaissance of Model Context Protocol (MCP) endpoints by January 2026. Attackers are not waiting for agentic AI to mature. They are already mapping it.
Direct injection versus the harder problem: indirect injection
Direct prompt injection is the attack most teams already picture: a user types "ignore previous instructions" into a chat box, hoping to override the system prompt. It is real, and documented testing found the autonomous coding agent Devin AI entirely defenseless against it, allowing attackers to expose server ports, leak access tokens, and install command-and-control payloads through plain natural language.
Indirect prompt injection (IPI) is more dangerous because nothing about it looks like an attack from the user's side. The malicious instruction is embedded in content the agent retrieves as part of normal work: a web page, a README file, a support ticket, an API response. The agent reads it, treats it as legitimate context, and executes the embedded instruction with no signal to the human operator that anything unusual happened.
Two documented 2025-2026 incidents show how this plays out in practice:
- A Google Docs file triggered an AI coding agent to fetch attacker-authored instructions from a malicious MCP server, executing a payload that harvested secrets without any user interaction.
- Anthropic's official Git MCP server carried three prompt injection vulnerabilities (CVE-2025-68143, CVE-2025-68144, CVE-2025-68145) discovered in January 2026, where a poisoned README or issue description alone was enough to trigger code execution.
A public red-teaming exercise cited in the same research ran 1.8 million prompt injection attempts against production systems and recorded more than 60,000 successful policy violations, a 3.3% success rate that, at enterprise scale, is not a rounding error.
Tool poisoning: the MCP supply-chain risk
MCP has become the standard way agents discover and call external tools, but that convenience cuts both ways. When an agent reads a tool's metadata (its name, description, and schema) to decide how to use it, that metadata is itself an injection surface. A tool description crafted by an attacker can instruct the agent to take unintended actions the moment it is loaded, before any user prompt is involved. Any team wiring third-party MCP servers into an agent workflow is importing that server's trust boundary along with its functionality.
What an unsecured agent actually costs
This is not a theoretical risk premium. IBM's 2025 Cost of a Data Breach Report found that breaches involving AI systems with poor access controls averaged $5.72 million, while organizations with comprehensive AI security controls in place saved roughly $1.9 million per incident relative to that baseline. The security investment pays for itself well before the second incident.
A practical starting checklist
Before an agent gets write access to anything real:
- Treat every retrieved document as untrusted input, the same way a web app treats user-submitted HTML. Sanitize and constrain what an agent is allowed to interpret as an instruction versus data.
- Scope permissions per task, not per agent. A support agent does not need shell access; a coding agent does not need production database credentials for an unrelated system.
- Vet every MCP server and tool description before connecting it, and pin versions rather than trusting metadata that can change after integration.
- Log agent decisions, not just outputs, so an indirect injection that produces a plausible-looking result is still visible to a human reviewer, an approach we cover in more depth in our look at the agent observability gap.
- Assume shadow deployments exist. If staff are already running unapproved agents, as we found in our analysis of shadow AI governance, those are the ones with no injection defenses at all.
None of this requires slowing agentic AI adoption to a crawl. It requires treating agent security as infrastructure, built in before the first production task, not bolted on after the first incident. ThinqHub's AI services and IT support build that layer into deployments from day one, and our approach starts with the governance and access controls most rollouts skip. If your agents already touch real systems and you have not stress-tested them against injection, talk to us before an attacker does it for you.
