Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Are the Key AI Agent Security Statistics for 2026?
Of 15 AI agents and 86 AI security products reviewed, none describes replacing the customer data an agent reads on a screen with tokens it can work with. Published flaws in AI agents rose from 92 to 616 in a year, and most large-company annual reports now name AI as a risk.
This page gathers the headline numbers from every original RedactSure Research report in one place. Each figure comes from a report that sets out its method, its sources and its limits, and each line below links to that report. The reports read vendors' public documentation and public records such as the National Vulnerability Database, federal breach filings, annual reports filed with the SEC and state legislative records. Where a figure describes documentation, it describes what vendors write, not how their products behave under test.
Key findings
- Of 15 AI agents and 86 AI security products reviewed, none describes replacing the customer data an agent reads on a screen with tokens it can work with (Do AI Agents Ask Before Making a Payment?; How Many AI Security Products Control What an AI Agent Sees?).
- Only 6 of 15 AI agents reviewed document asking a person before completing a payment or purchase (Do AI Agents Ask Before Making a Payment?).
- Only 1 of 16 AI agent products reviewed publishes a prompt injection rate (How Many AI Agent Vendors Publish a Prompt Injection Rate?).
- 616 security flaws in AI agents, MCP servers and agent platforms were published from October 27, 2025 to October 26, 2026, against 92 in the twelve months before (How Many Security Flaws in AI Agents Were Published in the Last Year?).
- More than half of the people affected by large healthcare breaches in 2025 and 2026, 123.9 million of 220.0 million (56.3%), were exposed in breaches that came through a vendor, a business associate under HIPAA (How Many Healthcare Breach Victims Were Exposed Through a Vendor?).
- 55% of all US public companies list AI as a risk in their 2026 annual reports, against at least 62 of the 100 largest (How Many Large Companies Are Warning Their Investors About the Risks of AI?).
What do AI agents document about the data they see?
| Statistic | Report |
|---|---|
| 0 of 15 AI agents reviewed describe protecting the customer data on a working page, such as account numbers or patient records, by replacing it with tokens the agent can work with. | Do AI Agents Ask Before Making a Payment? |
| 9 of the 15 keep passwords or credentials away from the model, against 0 for the customer data on the screen. | Do AI Agents Ask Before Making a Payment? |
| 6 of 15 document asking a person before completing a payment or purchase, and two of the six hedge. | Do AI Agents Ask Before Making a Payment? |
| In all 6 coding agents reviewed, secrets given to the agent are placed in environment variables the agent can read. Only 2 of the 6 document asking a person by default before the agent reaches the network or uses a credential. | Can AI Coding Agents Read Your API Keys? |
| 1 of 16 AI agent products publishes a prompt injection rate, and 7 products from 5 vendors state in their own documentation that the risk remains. | How Many AI Agent Vendors Publish a Prompt Injection Rate? |
The pattern is consistent: agents protect the password and leave the rest of the page in view. A model that reads an account screen reads the account numbers on it, and most agents leave the decision to pay with the agent itself.
What do AI security products control?
| Statistic | Report |
|---|---|
| 0 of 86 AI security products describe giving an agent tokens it can work with in place of the sensitive values it reads on a screen. | How Many AI Security Products Control What an AI Agent Sees? |
| 58 of 86 control where data can go, and 27 control what a model receives in pipelines or traffic they handle. | How Many AI Security Products Control What an AI Agent Sees? |
| None of the 86 describes recording the rendered screen an agent read when it acted. 36 record prompts or request payloads at their own gateway or pipeline. | How Many AI Security Products Control What an AI Agent Sees? |
Security tools govern the paths data travels and the text sent to a model through their own gateways. An agent working in an application reads the screen, which sits outside both.
How often do attacks on AI agents work, and how fast are flaws growing?
| Statistic | Report |
|---|---|
| Attacks tuned to each defense got past most of 12 published defenses more than 90% of the time, including defenses that had reported near-zero rates on their own tests (Nasr et al., 2025). | How Often Do AI Agents Follow Injected Instructions? |
| 207 of the 616 flaws published in the last twelve months (34%) let an attacker get data the agent, its tools or its server could reach. | How Many Security Flaws in AI Agents Were Published in the Last Year? |
| 150 CVE records published from April 2023 to October 21, 2026 describe prompt injection against an AI system, and 92 of them were published in the most recent four quarters, against 29 in the four quarters before. | How Many Prompt Injection Vulnerabilities Have Been Published? |
These are published records, not attacks. Part of the rise reflects a new and fast-growing category and more researchers looking at it, and hosted products rarely receive CVE identifiers, so a low count for one product means few records, not few flaws.
What do breach records, annual reports and state laws show?
| Statistic | Report |
|---|---|
| 123.9 million of the 220.0 million people affected by large healthcare breaches in 2025 and 2026 (56.3%) were exposed through a vendor, a business associate under HIPAA, and about 1 in 3 of these breaches comes through a vendor year after year. | How Many Healthcare Breach Victims Were Exposed Through a Vendor? |
| Of the 87 largest US companies that describe using AI in their annual reports, at least 55 also warn investors about it. Only 13 of the 100 largest name AI agents or agentic AI as a risk. | How Many Large Companies Are Warning Their Investors About the Risks of AI? |
| Of 45 AI laws enacted in California, Colorado, Illinois and New York in 2025 and 2026, 4 require a person to review or approve an AI decision. | How Many AI Laws Require Human Review of AI Decisions? |
What are buyers searching for and developers saying?
| Statistic | Report |
|---|---|
| US searches for "prompt injection" grew about 13 times between summer 2025 and spring 2026. Searches for "ai controls", "ai oversight" and "ai accountability" grew faster than searches for "ai governance". | Which AI Security Searches Are Growing Fastest? |
| Of 741 developer comments about Meta Muse, 109 raised security or privacy concerns, about 1 in 7. Of 646 about OpenAI Dots, 101 did, about 1 in 6. | How Did Developers React to Meta Muse and OpenAI Dots? |
What do the numbers mean for security and compliance leaders?
Read together, the reports describe one gap. Agents are reaching into the applications that hold customer, patient and financial records. The controls written about them sit on credentials, on where data can go and on the text a gateway handles. None of the agents or security products reviewed describes changing what the agent reads on the screen itself, and most agents do not describe asking a person before they pay. Meanwhile the published flaw count is climbing, regulators are writing human review into law in a few states, and most large companies now name AI as a risk to investors. A review team can use these figures to ask each vendor two questions: what does the model receive from the screen, and who approves the action.
Methodology and limitations
This page compiles the headline figures of twelve RedactSure Research reports and adds no new data. Each figure is quoted as its report states it, with the report's own scope: the agent and product counts cover only the products those reviews read, not the market. Agent and product figures describe public documentation read on the dates each report gives, never tested behavior, and "not described" never means a product cannot do something. Flaw counts are published records, not attacks. Breach figures come from the federal breach portal for breaches affecting 500 or more people. Search figures are relative interest, not volumes. Developer comment figures cover developers on Hacker News in the weeks after each product's release, not buyers or the public. Method, sources and limits for every figure are in the linked report. The page is refreshed as reports are updated.
Frequently asked questions
What share of AI agents protect the data they see on screen?
None of the 15 AI agents reviewed describes replacing the customer data on a working page with tokens the agent can work with. Nine describe keeping passwords or credentials away from the model. The same gap appears in 86 AI security products reviewed.
How many security flaws in AI agents were published in 2026?
616 flaws in AI agents, MCP servers and agent platforms were published from October 27, 2025 to October 26, 2026, against 92 in the twelve months before. 207 of the 616 let an attacker get data the agent, its tools or its server could reach.
Do AI agent vendors publish how often prompt injection succeeds?
One of 16 AI agent products reviewed publishes a rate, measured on its vendor's own tests. Seven products from five vendors state in their documentation that the risk remains.
Where do these statistics come from?
From twelve original RedactSure Research reports built on vendor documentation, the National Vulnerability Database and GitHub advisories, the federal healthcare breach portal, SEC annual reports, state legislative records and search trend data. Each report lists its sources.
How RedactSure Closes the Screen Gap
Every count above stops at the same place: what the agent reads on the screen. RedactSure works there.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: an agent working a patient account reads the name, date of birth and member ID on the screen, and any instruction hidden on the page can send them on. Inside the governed environment: render-layer tokenization shows the agent PATIENT_001 instead of the name, the agent completes the task, and a named person approves each consequential action under Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
These numbers describe the market. Bring one agent workflow and see, with test values, what the model reads and who approves each action. Book a demo