Security

A new Cloud Security Alliance survey has put numbers on what many IT leaders have been quietly dreading: enterprises don’t know what AI agents are running in their own environments. Not some of the time — most of the time. And the consequences are already showing up as real incidents. The Numbers The Cloud Security Alliance surveyed 418 IT and security professionals in January 2026, commissioned by Token Security. The findings are stark: ...

It’s not a thought experiment anymore. Indirect prompt injection — the attack where malicious instructions are embedded in web content and executed by AI agents that browse that content — is happening on live websites right now. Two independent security research teams confirmed it this week, and the implications for anyone running an AI coding assistant or agentic browser tool are significant. What the Research Found In back-to-back reports published this week, Google Threat Intelligence and Forcepoint X-Labs laid out real-world evidence of indirect prompt injection (IPI) attacks operating at scale. ...