Summary
- 49.8% of respondents confirmed or suspected unintended AI-agent activity.
- Only 12.5% reported consistent end-to-end tracing; 17.5% automatic containment.
- Survey perceptions and Salt Labs production telemetry are separate evidence sets.
Nearly half of the security and technology professionals surveyed by Salt Security said they had confirmed or suspected that an AI agent in their organisation took an unintended, unexpected or unauthorised action during the previous 12 months. The company’s State of Agentic AI and API Security 2H 2026 report, published on 13 October, combines responses from more than 380 professionals with production telemetry from hundreds of customer environments.
The headline proportion is 49.8%, but it combines confirmed experiences with suspicion. It should not be presented as evidence that half of all enterprises suffered a proven security breach. Respondents could identify actions outside their intended workflows without establishing malicious intent, compromise or a loss event. Among those reporting such activity, more than half cited an unauthorised external API call or transaction, and more than 40% said an agent modified or deleted data.
Deployment levels in the survey are high. Salt reports that 86.4% of respondents had at least one AI agent operating in their organisation and 59.5% had more than ten. Some 76.8% said agents could chain actions across other agents, tools and application programming interfaces. Such chains can make the consequence of a prompt difficult to predict: the first system receiving an instruction may not be the system that eventually accesses a business record or performs a transaction.
Visibility appears weaker than deployment. Only 12.5% of respondents said they could consistently trace a complete agent path from the initial instruction through tools and APIs to its outcome. More than 60% reported needing hours or days of manual work to reconstruct a previous day’s activity. The ability to reconstruct that sequence affects incident investigation because an action may depend on credentials, external tools and intermediate systems that record events separately.
Containment was another reported limitation. Only 17.5% said their organisation could automatically stop an agent behaving unexpectedly in production; other respondents described manual interventions or taking an application offline. That contrast is an architectural problem as well as an operational one: software can execute several linked actions before a human sees an alert, particularly where the platform’s control mechanism operates after a tool call has completed.
Salt also asked about Model Context Protocol infrastructure. Some 32.9% of respondents said they had found an unauthorised, shadow or misconfigured MCP server in the previous year, while 54.3% either confirmed or suspected such a finding. Separately, Salt Labs says it detected MCP-related infrastructure in 21.6% of its observed customer environments in August, up from 16.7% in January. The survey and telemetry percentages measure different populations and cannot be merged into a single prevalence rate.
The company links those findings to controlled research involving the Manus agentic AI platform. Its researchers say a malicious email in their demonstration could induce an agent to reach connected email, storage and repository accounts without the user clicking a link, with a guardrail detecting the behaviour too late to prevent some activity. A demonstration under research conditions illustrates an attack path; it does not establish that equivalent compromise occurred across the surveyed organisations.
The report also states that 83.5% of respondents believed AI-generated or assisted code contributed to at least some application security findings, while 6.8% said they resolved issues inside the coding assistant when code was generated. These are respondents’ estimates, not a direct audit of code provenance or a measured failure rate. The findings are internationally sampled, so any claim about Britain or Europe specifically requires a verified regional breakdown. Salt’s researchers report that access to enterprise services is spreading while most surveyed participants still lack complete tracing or automatic containment.
