Enterprises spent the last decade training employees on phishing awareness, enforcing least-privilege access, and deploying zero-trust architecture to contain the insider threat. Now they’re deploying AI agents — systems that act with the speed of software and the access of a privileged employee — and the security posture hasn’t kept up. According to a new survey, 97% of enterprise security, fraud, and AI leaders expect a material AI-agent-driven security or fraud incident within the next 12 months. Most of them are right to worry.
The Scale of What’s Actually Happening
The numbers around AI agent deployment in 2026 are striking enough on their own. Gartner estimates that 40% of enterprise applications will integrate with task-specific AI agents by the end of this year, up from less than 5% in 2025. Autonomous agents now outnumber human users in enterprise environments by an 82-to-1 ratio. They’re querying databases, calling APIs, reading and writing files, sending communications, and taking actions — constantly, at machine speed, with credentials that often carry broad permissions.
This is, by any reasonable definition, an insider threat problem. The difference is that traditional insiders are humans who can be interviewed, monitored over time, and held accountable. Agents are non-deterministic systems that leave sparse, often opaque audit trails — and they operate at a scale and speed no human compliance team can track manually.
Palo Alto Networks Chief Security Intelligence Officer Wendi Whitmore put it plainly at the start of this year: AI agents are “2026’s biggest insider threat.” That assessment, made in January, has only looked more prescient as the year has progressed.
The Attack Surface Is Different From Anything That Came Before
Understanding why AI agents are uniquely risky requires understanding how they fail — and how they can be deliberately exploited.
Prompt injection is the most immediate concern. A well-crafted adversarial prompt, embedded in a document an agent reads or a webpage it browses, can redirect the agent’s behavior mid-task. Unlike a phishing attack on a human, there’s no psychological friction to overcome — no moment of hesitation before clicking. If the input makes it into the agent’s context, the agent acts on it. In reported simulations, a single successful prompt injection allowed attackers to instruct an agent to exfiltrate customer data, delete backups, and execute financial transactions without any human in the loop being aware until after the fact.
Privilege escalation follows naturally from how agents are typically provisioned. Enterprises often grant agents broad service-account credentials — because restricting them would break the workflows agents are supposed to automate. The result is what security researchers are calling the “superuser problem”: an agent accumulates access to multiple sensitive systems, and any compromise of that agent amounts to a compromise of everything it touches. More than 35% of AI vulnerabilities in documented cases involve APIs and the non-human identities that control them.
Memory poisoning is the most insidious threat of all. Long-running agents often maintain persistent memory — context that carries forward across sessions so the agent can learn from previous interactions and improve over time. An adversary who can implant false or malicious information into an agent’s long-term storage doesn’t just affect one session; they affect every future session until the poisoning is discovered. The agent “learns” the malicious instruction and recalls it days or weeks later. Unlike a prompt injection, there may be no obvious triggering event to investigate.
Cascading failures amplify all of these risks. In multi-agent systems — where one agent’s output feeds another’s input — a single compromised agent can propagate malicious behavior through an entire network of downstream processes. Simulated scenarios have found that a compromised agent in a multi-agent pipeline could poison 87% of downstream decision-making within four hours. At enterprise scale, that’s an incident response team’s nightmare.
What the Market Is Saying
The clearest signal that AI agent security has moved from a theoretical concern to an urgent priority is where the money is going.
On April 30, 2026, Palo Alto Networks announced its intent to acquire Portkey — a startup that built what’s known as an AI Gateway. Portkey sits between an enterprise’s AI agents and the LLMs, APIs, and tools they interact with. Every token in, every tool call, every model response flows through Portkey’s control plane, which logs it, enforces access policies on it, and applies guardrails before anything reaches production systems.
The acquisition is significant for several reasons. First, Palo Alto is a bellwether for enterprise security priorities — the company has a track record of identifying which security categories are about to become mainstream and acquiring into them early. Second, Portkey was already processing trillions of tokens per month before the acquisition, suggesting the AI Gateway category has already achieved meaningful enterprise adoption. Third, the deal positions Palo Alto to make its Prisma AIRS platform — which handles AI risk, identity, and security — into a unified control point for organizations running AI at scale.
The announced valuation of around $120–140 million is, by the standards of enterprise security acquisitions, relatively modest. That reflects Portkey’s early-stage status. But it also suggests that the hard part isn’t building the gateway itself — it’s integrating it into an enterprise security stack that organizations already trust, which is precisely what Palo Alto can provide.
What Good AI Security Looks Like in Practice
The Portkey acquisition illustrates the direction the industry is moving: toward centralized control planes that sit between agents and everything they touch. But the architecture alone isn’t sufficient. Organizations that are ahead of this curve tend to combine a few key practices:
Least-privilege provisioning for every agent. Just as a junior analyst shouldn’t have root access to production databases, an agent designed to summarize sales reports shouldn’t have write access to CRM records. In practice, this is harder than it sounds, because agents are often deployed by product teams that aren’t thinking about security provisioning. The discipline needs to come from the platform level.
Human-in-the-loop checkpoints for consequential actions. Agents can operate autonomously across low-stakes tasks indefinitely. But any action with financial, data-deletion, or access-control implications should require explicit human approval before execution. This isn’t about limiting AI capability — it’s about recognizing that the cost of a wrong autonomous action in these categories is categorically higher than the cost of a five-second human confirmation.
Structural observability, not instrumentation as an afterthought. The standard approach to monitoring enterprise software — adding logging calls where engineers remember to add them — doesn’t work for agent systems. Agent behavior is non-deterministic and spans multiple hops, tool calls, and model interactions in a single workflow. Observability needs to be structural: capturing every LLM call, every tool invocation, and every memory access at the infrastructure layer by default, regardless of how individual agents are implemented.
Tamper-evident audit trails. When an incident occurs — and, given the survey data, the question is when rather than if — organizations need records they can trust. Audit logs that agents themselves can modify are insufficient. The control plane needs to maintain records that are architecturally isolated from the agents it’s monitoring.
The Honest Tension
There is a real tension at the center of this conversation that’s worth naming. The reason enterprises are deploying AI agents aggressively is that they deliver genuine productivity gains. Restricting agents to prevent security incidents isn’t a neutral policy — it has a business cost. Organizations that over-restrict agents will find themselves at a competitive disadvantage relative to organizations that have gotten security right and can deploy agents confidently.
This is, perhaps, the clearest framing of why AI agent security matters: it’s not about slowing AI deployment. It’s about building the infrastructure that makes it possible to deploy AI agents at scale without accepting unacceptable risk. The companies that get this right will be able to move faster, not slower, because they won’t be paralyzed by the fear of what an autonomous agent might do in production.
What to Watch
The Portkey acquisition won’t be the last deal in this category. The AI Gateway space — sitting at the intersection of AI infrastructure, security, and observability — is one of the more defensible positions in the enterprise AI stack, and Palo Alto’s move will accelerate interest from other security vendors.
Beyond consolidation, watch for regulatory movement. The EU AI Act’s requirements around high-risk AI systems are beginning to create compliance pressure in European markets, and agentic systems that make consequential decisions autonomously are likely to fall under heightened scrutiny. U.S. regulators have moved more slowly, but the combination of high-profile incidents and an 82-to-1 agent-to-human ratio in enterprise environments is the kind of thing that attracts congressional attention.
And watch the open-source ecosystem. Just as infrastructure tooling for LLMs matured quickly through community contribution, observability and security tooling for agent systems is beginning to accelerate. Organizations that wait for the market to stabilize before investing in this infrastructure will find the gap has widened.
The fundamental insight is simple: AI agents are not tools. They are actors — systems that make decisions, take actions, and produce consequences in the world. Enterprises that treat them as sophisticated software to be deployed and forgotten will learn the same lesson organizations learned about cloud misconfigurations a decade ago, just faster and at greater cost. The enterprises that treat them as a new category of organizational actor — one that requires governance, visibility, and accountability — are the ones that will be able to use them well.
