A vendor says 88 percent of companies had an AI agent security incident. The vendor sells the fix. It is still true.

AvePoint's 2026 State of AI report says 88.4 percent of organizations had at least one AI agent-related security breach in the past year. Data leakage and manipulation through malicious input were the top two causes, each around half.

Before you repost that number, notice what is wrong with it.

AvePoint sells AI governance and security tooling. A survey that finds nearly every company has already been breached is, conveniently, a survey that sells AvePoint's product. "At least one incident" is also a low bar that can absorb everything from a real breach to a minor misconfiguration someone caught in testing. It is self-reported, from 750 respondents, funded by a company with a direct financial interest in the scariest possible result. If you dismissed it as vendor fear marketing, that would be a reasonable instinct, and it is the instinct I started with.

So I did not take their word for it. I went looking for independent, non-commercial sources to see whether they describe the same risk.

They do, and that is what makes this worth writing about. OWASP now ranks prompt injection as the number one risk for LLM and agent applications, and its 2026 agent security work catalogs real CVEs and breach reports rather than hypotheticals. Help Net Security reported in June that prompt injection still drives most agentic AI security failures in production. OWASP is a volunteer security project with nothing to sell you. When a tooling vendor, an independent security foundation, and the trade press all point at the same failure, the failure is real even if the vendor's exact percentage is soft.

Here is what those two causes actually mean, from someone who has cleaned up incidents.

Data leakage means an agent could reach more than it should, and that access walked out the door. You connect an agent to your files so it can be useful, and now everything it can read is everything it can expose. Prompt injection is the stranger one, and the more dangerous. It means someone hid instructions inside a document, an email, or a web page, the agent read them, and the agent obeyed. The agent did not malfunction. It worked perfectly. The problem is that it could not tell your instructions from an attacker's.

None of this is exotic. It is the same access and identity mistakes we have been making with software for twenty years, now bolted onto something that can act on its own. Companies hand agents broad access because narrow access is tedious to configure. They do not log what the agent does. They never sit with the plain fact that an agent reading outside content is an agent taking orders from outside people.

The fix is boring, which is exactly why people skip it. Least privilege, so the agent can only touch what its task requires. Logging, so you can reconstruct what happened when something goes wrong. A hard line between trusted instructions and untrusted content, so a poisoned document cannot drive your systems. This is old security applied to a new thing, which is the work MojoSecurity and MojoAI do together.

I will give the skeptic the last honest word. The 88 percent is probably inflated by who funded it and how it was collected, and you should discount vendor-sponsored fear on principle. But discount it by half and you are still at most companies. The independent sources are not selling anything, and they agree the risk is here now. If you are putting an agent anywhere near real data, get the access model right before you switch it on. That is a far cheaper conversation than the one that happens after an incident.