Salt Security Report: Agentic AI Is Outpacing Security in 2026

The statistics in Salt Security’s 1H 2026 State of AI and API Security report are stark. Ninety-two percent of organizations lack the advanced security maturity required to defend AI agent environments. Nearly half, 48.9%, are entirely blind to machine-to-machine traffic and cannot monitor what their AI agents are actually doing. And 99% of the attack attempts Salt Labs analyzed originated from authenticated sources: not external attackers brute-forcing their way in, but rogue agents operating with legitimate credentials, no rate limiting, and no behavioral guardrails.

The report surveyed 327 security professionals in early 2026 and arrived at a conclusion that is becoming hard to avoid: organizations are deploying agentic AI faster than they’re building the security infrastructure to watch it.

The Rogue Agent Problem

The authenticated-source finding is the one that deserves the most attention, because it breaks how most security teams think about detection.

Traditional security operations work on a perimeter model: authorized users get in, unauthorized ones get blocked or detected. An attacker who gets past that perimeter gets treated with suspicion precisely because they’re doing something unusual with credentials they shouldn’t have. The alert triggers on the anomaly.

Rogue AI agents disrupt this model completely. When an agent is compromised, hijacked through a prompt injection or a malicious tool definition, or simply running a task it was never authorized to run, its API calls still look legitimate. The credentials are real. The request format is correct. The traffic patterns match what machine-to-machine communication is supposed to look like. There’s no anomaly for a perimeter-based detection system to catch.

Salt Labs found that rogue agents increasingly operate at the limit of their credential scope, making authorized calls to services they’re permitted to access but using the access for attacker-directed purposes. Exfiltrating data to an accessible storage bucket. Calling an API with legitimate parameters that produce attacker-useful results. Spinning up compute resources the attacker will later use. All of it authenticated, all of it looking like normal agent behavior to any system that only checks “is this request authorized.”

The Visibility Crisis

The visibility numbers explain why this is so hard to catch. Nearly half of organizations cannot see their M2M traffic at all, not even to answer the basic question of what their agents are talking to and how often.

The API explosion is part of the problem. Two-thirds of organizations reported more than 50% growth in API usage over the past year, driven by AI and automation adoption. Those APIs are being consumed by agents, integrations, and automation workflows faster than security teams can inventory them. Less than one in four organizations has a fully automated API inventory. The majority are relying on partial or manual tracking, which means they’re always running behind the actual attack surface.

That gap has real consequences. Salt Security found 47% of organizations have had to delay a production release because of concerns about securing APIs exposed to autonomous systems. The security debt from fast-moving agentic deployment is already slowing down engineering teams.

A New Attack Surface: WebMCP

Concurrent with the Salt Security findings, researchers from National Yang Ming Chiao Tung University published a paper in June 2026 documenting a new protocol-level attack class that makes the visibility problem worse. Their work on WebMCP, a protocol that allows websites to expose tools directly to AI agents bypassing traditional UI layers, identified what they call Mid-Session Tool Injection (MSTI).

The attack works by injecting malicious tool definitions into an active agent session using JavaScript mechanisms like the AbortSignal API or race conditions during tool registration. The agent’s visible tool set is modified mid-session without the user or the agent itself necessarily being aware. The researchers classify MSTI into two variants: Tool Hijacking, which modifies which tools the agent can see, and Tool Framing, which alters metadata fields like tool names, descriptions, and hints to manipulate how the agent uses tools it already trusts.

WebMCP represents exactly the kind of new attack surface that the Salt Security visibility problem creates. Organizations that can’t see M2M traffic can’t see MSTI attacks either. The agent accepts a modified tool definition, starts using it, and nothing in the existing monitoring stack catches the transition.

The Confidence Gap

79% of boards and executive teams have increased scrutiny of AI security risks, the report found. Only 18% are extremely confident in their ability to detect attacks using generative AI. That gap, high executive concern and low practitioner confidence, describes the state of agentic security in mid-2026 accurately.

The deployment decision is usually being made above the security team. The security team is then handed an agent environment they didn’t design and asked to secure it retroactively. That’s an extremely difficult position to be in when the attacker model is “legitimate credentials, authenticated requests, machine-speed operations, no human oversight.”

The report doesn’t offer a clean fix, because there isn’t one. The recommendations run to the expected: automated API inventory, behavioral baselines for agent traffic, purpose-built detection for M2M anomalies rather than retrofitting human-oriented monitoring. All sensible. All require organizational investment that’s slower than the pace of agent deployment.

References

• Salt Security — 1H 2026 State of AI and API Security Report
• Salt Security — As AI Agents Outpace Security, Most Organizations Face an Unsecured API Surge
• arXiv 2606.06387 — WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents