AI security risk is outpacing controls for LLMs and agents

At a glance

What this is: This is Akto’s 2026 analysis of the AI security threat landscape, with a focus on prompt injection, agentic AI risks, runtime controls, and AI security posture management.

Why it matters: It matters because AI agents and LLMs now participate in access decisions, tool calls, and downstream actions, which creates a governance problem for IAM, PAM, NHI, and security teams.

By the numbers:

• 69% of organizations have already deployed AI agents in real-world environments, rapidly expanding the enterprise attack surface.
• Only 21% of enterprises maintain a complete inventory of AI agents and MCP connections, creating major visibility gaps.
• 79% of organizations lack governance policies for AI agent permissions and monitoring, increasing the risk of unauthorized access and untracked AI behavior.
• AI now drives 83% of breaches, per Gigamon's 2026 survey of 1,000+ global security leaders.

👉 Read Akto's analysis of AI security risks, threats, and best practices for LLMs

Context

AI security is no longer limited to model safety or prompt quality. Once an LLM can call tools, retrieve context, or trigger workflows, the control problem shifts to identity, access, runtime monitoring, and governance. That is why treating AI like a normal REST API leaves a real gap in agentic AI security and NHI oversight.

Akto’s article reflects a broader industry pattern: the most material risks come from invisible integrations, weak permission boundaries, and poor inventory discipline. In practice, that places AI security alongside IAM, PAM, and workload identity rather than isolating it as a standalone model-risk concern.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: What do organisations get wrong about prompt injection?

A: They often treat it as a purely content-filtering problem. In practice, prompt injection is an instruction-trust problem that becomes serious when the chatbot can act on behalf of the organisation. The fix is not just blocking bad text. It is constraining what the model can access, what it can call, and what it can change.

Q: Which frameworks should teams use to evaluate AI security controls and accountability?

A: Use NIST AI RMF for governance, OWASP guidance for common AI attack patterns, MITRE ATLAS for adversarial techniques, and ISO 27001 where enterprise control mapping is needed. The framework should help teams prioritise, test, and evidence controls, not replace validation against the actual model, data, and agent workflows.

Technical breakdown

Prompt injection and indirect prompt injection

Prompt injection is a control bypass technique in which attacker-controlled text changes how an LLM interprets instructions. Direct prompt injection arrives through user input, while indirect prompt injection hides in retrieved documents, emails, web pages, or tool responses. In agentic systems, the danger is not only bad text generation. The model may follow the hostile instruction far enough to query data, send messages, or invoke APIs, which turns a language issue into an access-control problem. Runtime filters help, but the core weakness is that the model cannot reliably separate instructions from untrusted content without surrounding controls.

Practical implication: inspect both inputs and retrieved context before the model can act on them.

Identity and access control for AI agents

AI agents need explicit identity boundaries because they do not behave like static applications. A coding agent, support agent, and summarisation agent should not share the same permissions, data reach, or service credentials. In an enterprise setting, the meaningful control is not whether the model can answer a question, but whether it can touch a database, open a ticket, or execute a command. That makes service identities, least privilege, and audit logging part of AI governance. When an agent is compromised, shared credentials and broad tool access determine whether the event is contained or becomes a lateral movement path.

Practical implication: assign distinct service identities and narrow tool scopes to each AI system.

AI security posture management and inventory

AI security posture management, or AI-SPM, is the continuous discovery and control layer for AI assets. It tracks models, prompts, plugins, API connections, data flows, and shadow AI so security teams can see what exists before they try to govern it. This matters because agentic systems often appear through side projects, embedded SaaS features, or third-party integrations that bypass standard onboarding. Without inventory, policy enforcement and monitoring are partial at best. AI-SPM therefore bridges model governance and operational security, much like CSPM did for cloud, but with stronger emphasis on runtime behaviour and external dependencies.

Practical implication: build a live inventory of models, integrations, and MCP connections before scaling use cases.

Threat narrative

Attacker objective: The attacker wants to turn trusted AI workflows into a covert path for data exposure, unauthorized actions, or broader enterprise compromise.

1. Entry occurs when an attacker places malicious instructions into prompts, retrieved content, or connected tools that an agent will process as normal context.
2. Escalation follows when the model uses its assigned permissions to query systems, expose data, or request higher-privilege actions than the original task justified.
3. Impact occurs when the agent completes unintended actions, leaks sensitive data, or creates a broader access path that security teams cannot easily distinguish from legitimate automation.

NHI Mgmt Group analysis

AI agent governance is now an identity problem, not only a model-risk problem. Once agents can call tools, read data, and trigger workflows, the real control boundary becomes who or what is allowed to act. That changes the center of gravity for IAM, PAM, and NHI programmes. The organisations that treat agents as credentialed actors will govern them more effectively than those that treat them as chat interfaces.

Inventory is the first control, and without it AI security remains aspirational. Akto’s visibility findings reinforce a broader governance pattern: teams cannot enforce policy across assets they have not discovered. That is the same failure mode seen in machine identity sprawl and unmanaged service accounts. AI governance debt: the accumulating risk created when models, prompts, plugins, and MCP connections are deployed faster than they are inventoried and assigned ownership. Practitioners should read AI-SPM as a lifecycle discipline, not a point product category.

Least privilege only works in agentic AI when permissions are task-scoped and time-bounded. Broad tool access, shared credentials, and persistent API reach create blast radius that traditional app controls do not constrain. This is where NHI governance intersects directly with AI security, because agent identities need the same lifecycle discipline as service accounts and other machine identities. The practical conclusion is to narrow access by task, not by model trust.

Prompt injection is the visible symptom of a deeper trust model failure. The industry often frames the issue as malicious text, but the larger problem is that systems still trust retrieved content, user inputs, and tool responses too much. Security leaders should align AI controls with frameworks such as the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10, while treating runtime authorization as a core control plane. The takeaway for practitioners is clear: secure the decision path, not just the response text.

What this signals

AI security programmes will increasingly be measured by inventory quality, not just policy statements. When only a minority of organisations can see their AI agents and MCP connections, governance becomes fragmented before enforcement begins. That means the first programme milestone is a trustworthy register of agents, integrations, and owners, followed by continuous monitoring of tool use and data access.

Agent identities will need lifecycle controls that look more like NHI governance than classic application onboarding. As AI systems move from experimentation into production, teams will need revocation paths, access review triggers, and exception handling that match how agents actually operate. Practitioners should expect audit, privacy, and security teams to converge around the same evidence set.

AI-SPM should be treated as an operational control plane, not a reporting layer. The governance gap here is not lack of awareness, but lack of runtime enforcement across prompts, tools, and integrations. Teams that combine discovery, authorization, and logging will be able to constrain agent behaviour before the next wave of shadow AI expands the attack surface.

For practitioners

• Implement task-scoped agent identities Give each AI agent its own service identity, minimal permissions, and separate credentials so access can be revoked without affecting unrelated workflows.
• Build a live AI asset inventory Track every model, plugin, MCP connection, and external data source in a continuously updated register so shadow AI does not sit outside governance.
• Enforce runtime input and tool-call controls Inspect prompts, retrieved documents, and outbound API calls before execution, and block actions that exceed the task’s approved scope.
• Separate governance for model access and business access Treat system prompts, model configuration, and integration permissions as privileged assets with named owners and logging equal to other high-risk controls.

Key takeaways

• AI security has become an identity and governance issue because agents can act, not just answer.
• Visibility remains the main failure point, with most organisations still unable to inventory or govern all of their AI agents and connections.
• Task-scoped permissions, runtime checks, and lifecycle ownership are the controls that change AI security from theory into practice.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads — causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• AI Security Posture Management: A governance approach for discovering and tracking AI assets such as models, agents, datasets, vector stores, and related infrastructure. It becomes useful only when inventory is connected to runtime exposure and the identity that can actually reach the data.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

What's in the full article

Akto's full blog covers the operational detail this post intentionally leaves for the source:

• A deeper breakdown of AI-SPM discovery steps across models, plugins, prompts, and integrations
• Specific runtime control examples for prompt injection detection, output filtering, and tool-call validation
• Practical guidance on assigning service identities and audit trails to AI agents in production
• Implementation-oriented discussion of governance, compliance, and accountability mapping for AI systems

👉 Akto's full post covers the AI threat landscape, runtime protections, and governance details in more depth.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners connect identity controls to the operational realities of modern automation and AI.