Trend 1.1

AI Adoption Expands the Enterprise Attack Surface

AI models, systems, and agentic workflows are creating novel vulnerabilities that traditional cybersecurity isn’t designed to defend against. The top risks introduced to the enterprise environment include prompt injection attacks, data poisoning, and excessive agency.

Signals /

What we’re seeing

AI introduces new enterprise entry points

The vulnerabilities introduced to enterprise environments by AI are growing and evolving. On the one hand, AI-powered front ends create new entry points for hackers to exploit. Opponents can manipulate AI to expose sensitive data or take undesirable actions outside of its guardrails. Further, agents can become misaligned and diverge from the original goals assigned to them.

AI has amplified existing threat vectors, broadened the attack surface, and created new vulnerabilities that can be exploited by attackers.

Two under-covered channels are expanding this surface further. Shadow AI, meaning unmanaged personal AI accounts and unsanctioned MCP servers operating outside corporate visibility and token governance, gives attackers an entry point IT never provisioned or tracked. Separately, SaaS AI supply chain exposure arises when agents or connectors are built directly into everyday productivity tools like Word and Excel. Because these live inside sanctioned SaaS platforms, they escape the scrutiny applied to standalone AI deployments even though they carry the same exploitability.

Standard endpoint monitoring tools won’t catch shadow AI agents, cautions Valence Howden, advisory fellow at Infotech. A new category of AI governance, risk, and compliance tools that offer “registering, tracking, having agent cards, doing shadow detection, classification, and mapping” are filling the gap (Interview with Valence Howden).

The AI agent attack surface includes the APIs and MCP servers that AI agents use to access data and applications. APIs are already the most-exploited attack surface in enterprise software, and AI agents are accelerating that exploitation. Attackers use API abuse techniques to exploit APIs that carry more permissions than necessary for their task, are stored incorrectly and leaking data, or are misused and not logged or monitored. The attackers send requests that look legitimate but operate at a scale or use a sequence that the API was never intended to handle. MCP servers are another surface that can expose resources, prompts, and tools.

Analysis by security vendor Wiz (2026) found that about 80% of cloud environments expose at least one MCP server, and of those servers:

• About 70% return a full tool catalog to an anonymous caller.
• About 42% return real data when a tool is called.
• About 10% expose a sensitive back end.
• Nearly all use the original protocol version that did not include authentication, added March 2025.

Implications /

What it changes

Opportunity

Competing standards for trusted AI agents

The Artificial Intelligence Underwriter Company’s AIUC-1 is a security and reliability standard built in collaboration with more than 100 CISOs from Fortune 500 companies to establish a way for enterprises to adopt and create AI agents with confidence. The standard offers a certification to AI companies, who must implement more than 50 technical, operational, and legal safeguards and submit their AI to third-party technical testing. The standard is compared by its creators to SOC 2 for offering an independent audit report and a trusted framework to enable broad industry adoption. With consortium members including Meta, Anthropic, Google Cloud, Microsoft, and Salesforce, this indicates the industry is moving toward an industry-recognized standard for trusted AI agents (AIUC, 2025).

A second framework takes a different approach entirely. Where AIUC-1 offers a point-in-time certification, the Cloud Security Alliance’s Agentic Trust Framework (ATF), published in February 2026, applies zero trust principles continuously. Agents start with minimal autonomy and earn greater access only as they demonstrate trustworthiness against defined maturity gates, with any significant security incident triggering automatic demotion back down. Trust given to an agent isn’t fixed, but a dynamic revocable status tied to observed behavior (Cloud Security Alliance, 2026).

Risk

When AI has an identity crisis

Agentic AI is putting more pressure on the identity and access management (IAM) capabilities and security of organizations. A link between the teams accountable for deploying AI systems and IAM security teams will become more important. Collaboration will be essential to understand if an agent’s assigned identity permissions are in scope for the tasks it’s expected to automate. As AI agents from different platforms enter the environment, enterprises will have increased risk as observability becomes more complex. It will simply be more difficult to monitor all the agents in your environment and audit their privileges and interactions with other agents. Organizations will need to coordinate around identity as a central pillar of security and train up existing cybersecurity talent on how to manage identity for AI agents.

Examples /

Who’s already moving

The following exploits were found out in the wild – executed by real hackers against their targets – not demonstrated by security researchers in a lab. The impacts were real negative press and reputation damage for the companies involved.

Token jacking: Millions in charges after credentials stolen

Unit 42 says that it has responded to cases where adversaries stole inadvertently exposed credentials and connected them with a grey market reseller within minutes. The credentials are used in “transfer stations” that resell access to frontier AI models as a middleman, at a steep discount to full retail price. The impact can be millions of dollars of charges being racked up before the unauthorized access is discovered. Charges can be difficult or impossible to recover from AI services (Unit 42, 2026).

Hacker exploits Amazon Q extension

A hacker inserted destructive system commands into Amazon’s Visual Studio Code extension used to access AI coding assistant Q. The code instructed the AI agent to behave like a system cleaner, aiming to erase user data and cloud resources. The hacker used an unverified Github account and submitted a pull request to Amazon’s repository, and Amazon released the compromised version before realizing it had been tampered with. Amazon later patched the code, closing the security risk (CSO Online, 2025).

Vibe-coding agent deletes executive contacts database

Investor Jason Lemkin was working with Replit’s AI coding agent, building a front end for a database of business contacts. After telling the agent to “freeze” the code, he returned to the project to find Replit had erased all records in the database. The agent tried to conceal the deletion but later admitted to what took place. Replit was later able to recover Lemkin’s data (Fast Company, 2025).

Meta’s AI agent hands over access to Sephora’s Instagram account

Meta’s AI support agent added an attacker’s email to a target’s Instagram account simply when asked to do so. Hijacked accounts include Sephora, a leader in the U.S. Space Force, and a dormant White House account from the Obama presidency. Users reporting their accounts as stolen said there was no way to escalate their problem to a human (404 Media, 2026).

OpenAI’s rogue agent escapes its sandbox

OpenAI was running a red-team exercise with an unreleased frontier model when the model escaped its sandbox and exploited a third-party server to attack AI development reference site Hugging Face. It autonomously took about 17,600 actions over five days to steal credentials, escalate to root access, and gain administrator-level control. The agent’s motivation was to steal the answer key for its evaluation rather than legitimately form the answers. Hugging Face says the agent read from one internal database and did not affect customer models or files or cause any malicious code to ship into the supply chain. The agent mapped out more ways to cause harm than it actually acted upon. The volume and speed of the autonomous action taken in the attack overwhelmed ordinary detection until investigators used another AI model to help reconstruct the timeline (Hugging Face, 2026).

Recommendations /

What leaders can do

1. Implement red-teaming for your AI systems

   Many examples of the top AI risks identified publicly were revealed by security researchers or exploited by hackers that chose to not take full advantage of the compromised systems. Don’t rely on a good Samaritan to improve your cybersecurity program – stress test your own systems with an internal red team that actively tries to exploit them. Securing new AI systems is new territory for the enterprise and new methods to corrupt them are still coming to light, so relying on documented procedures and best practices won’t cut it. You need to actively practice security in this domain and think like your opponents. Create a team of ethical hackers in your security group to simulate attacks and then identify and mitigate the vulnerabilities that come to light. Here are a couple of red-teaming techniques to consider for your own playbook:
   • Assume compromise. Give your ethical hackers an initial foothold on your internal network. Assume the perimeter will be breached eventually and then see how quickly your organization can detect and respond to a threat. How much can you contain the collateral damage once the first wall of defense is overcome (Verizon, 2026)?
   • Prepare for relentless bombardment. Real hackers won’t just try once, find a barrier, and then give up. Test if your systems will consistently deny disallowed prompts by using automation in your red-teaming process that will tirelessly try different wordings and conversation approaches to bypass your AI guardrails (Thinking Machines, 2026).
   Infotech resource: Get Started With AI Red-Teaming

2. Focus on the identity layer to improve security

   In multi-agent systems, one compromised agent can spoof the identities of others and orchestrate an entire cluster of agents out of alignment. To prevent this cascading effect, secure the ways you have agents prove their identities, communicate with other agents, and access data or resources. Agents should attest to a human owner and progress through a trust maturity model that ties the level of autonomy granted to an agent to how well it can verify its own identity (Interview with Carlos Rivera). Unlike employees, AI agents currently have no equivalent of onboarding, role changes, or offboarding and no authoritative record tying an agent to an accountable human owner. Organizations should establish a central agent registry that captures every agent regardless of origin, whether issued through a corporate identity provider or spun up as a local account, and assigns each one a named owner responsible for its purpose, permissions, and lifecycle. This is an enhancement of your identity security architecture, expanding your identity types, repositories, threats, and mitigations to include AI agents. Read more in Assess and Govern Identity Security.

Bibliography /

Sources

1. “AIUC-1 × OWASP Top 10 for Agentic Applications.” AIUC, 27 May 2026.
2. “AIUC-1: Crosswalks OWASP Top 10 for Agentic Applications.” OWASP, 25 May 2026.
3. Hylender, C. David, et al. “2026 Data Breach Investigations Report.” Verizon, 2026.
4. “Interaction Models: A Scalable Approach to Human-AI Collaboration.” Thinking Machines Lab, 11 May 2026.
5. Koebler, Jason. “Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked.” 404 Media, June 1, 2026.
6. Kvist, Rune. “Launching AIUC-1: The Standard for AI Agents.” Artificial Intelligence Underwriting Company (AIUC), July 17, 2025.
7. Larcher, Hugo, et al. “Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident.” Hugging Face, 27 July 2026. huggingface.co/blog/agent-intrusion-technical-timeline.
8. Ramati, Hila. “The Risk Hiding behind Exposed MCP Servers.” Wiz Blog, Wiz, 28 July 2026. Accessed 6 Oct. 2026.
9. Sullivan, Mark. “Replit CEO: What Really Happened When AI Agent Wiped Jason Lemkin’s Database (Exclusive).” Fast Company, 22 July 2025.
10. Thomas, Prasanth Aby. “Hacker Inserts Destructive Code in Amazon Q Tool as Update Goes Live.” CSO Online, 24 July 2025.
11. “Token Jacking: Cybercriminals Could Be Stealing Your AI Resources.” Unit 42, Palo Alto Networks, 6 Aug. 2026.
12. Woodruff, Josh. “The Agentic Trust Framework: Zero Trust Governance for AI Agents.” Cloud Security Alliance, 2 Feb. 2026.

Trend 1.2

RPA Is Dead, Long Live IPA

As agentic AI becomes the focus for automation efforts, is rules-based robotic process automation obsolete? Leading RPA vendors are scrambling to adapt to “intelligent process automation” after stalled growth, but a deeper look shows RPA isn’t disappearing, it’s just part of a bigger automation landscape.

Signals /

What we’re seeing

Rumors of RPA’s death have been greatly exaggerated

Intelligent process automation is expanding the range of work that organizations can automate, but it does not eliminate the need for deterministic execution. AI agents can interpret unstructured information, plan actions, and respond to exceptions. RPA remains better suited to repeatable actions that require consistent execution. The emerging architecture combines the two rather than forcing organizations to choose one.

UiPath is shifting its business model to a hybrid between RPA and agentic AI. Both are needed for successful automation, according to the company’s CEO. “Give an AI model the same task repeatedly and you’ll get different results, whereas RPA is rule-based and far more reliable. So a probabilistic agent is not architecturally meant to follow a dozen, sometimes hundreds of steps in the same order — that’s what the deterministic way does” (UiPath, qtd. in Seeking Alpha, 2026).

The hybrid approach adopts agentic solutions and allows them to execute RPA processes where they help with automation, bringing in large language models (LLMs) to further extend automation into a process. UiPath is also launching agent orchestration software and renamed its annual user conference to “Agentic AI Summit.”

UiPath’s competitors are following suit. Automation Anywhere launched its Agentic Process Automation platform and expanded it in May with new orchestration capabilities, rebranding its legacy as an RPA leader (Automation Anywhere, 2026). SS&C Blue Prism unveiled WorkHQ, an agentic automation platform with orchestration features, in April 2026 (SS&C, 2026).

These vendors are responding to financial analyst pessimism about their ability to survive the AI wave by repositioning their platforms as enterprises move beyond isolated automation and execution. Leading with agentic AI branding puts the new layer of probabilistic automation in focus, but their RPA solutions continue to be a big piece of the overall automation puzzle. The strategy is having mixed results for the vendors’ market prospects. As for the market category, RPA is being recast as a broader business automation platform category. One projection has RPA market size growing from $35 billion in 2026 to $87.5 billion by 2030 (Flobotics, 2026).

(Flobotics, 2026)

In summary, the major RPA vendors are converging on a common set of approaches. Their platforms will orchestrate work across agents, bots, APIs, enterprise systems, people, etc. They are all repositioning RPA as an execution mechanism within a broader automation platform.

Timeline: Three journeys from RPA to IPA

(Sources: UiPath, Automation Anywhere, SS&C Technologies)

Implications /

What it changes

Opportunity

Reduce cost of operations with IPA

Intelligent automation can simplify processes, reduce resource use, and improve operational efficiency. Improve your time to market and production output while reducing operating costs. Intelligent automations make end-to-end process automation possible with minimal human intervention and are continuously improved through monitoring and iteration.

Opportunity

Free up skilled labor for customer-facing work

Workplace specialists can often get bogged down in repetitive process work because they are the only ones qualified to do it. If IPA can expand from a task-based automation approach to a multi-step process that includes more mature decision support to either automate or augment that work, then specialists can shift to a more advisory focus and help customers directly.

Risk

Selecting the right tool for the job

Many enterprises select an IPA platform but never take advantage of the orchestration-level capabilities available, sticking to only the RPA-level improvements they could have achieved with a less complex solution. Choosing the right automation platform is key, and organizations shouldn’t always default to IPA solutions if they aren’t necessary. Some guidelines on choosing the right automation platform:

• Choose IPA if you are automating a process or function and human supervision is not required. Your goal is either efficiency or decision support, and scalability is a requirement (Shukla, 2023).

Jay Upchurch, CIO of SAS, draws the dividing line at reversibility rather than task complexity. “One of the traditional problems of consumption and storage is that when you’re starting to run out, you’ve got to allocate more. I can lean on automation to allocate more without really worrying about the risk of major disruption. I can safely take the human out of the loop in this case,” he says. “But, if that remedy was something as dramatic as a restart of a service, or pulling down the latest version of code from a Git repository as part of the remediation, that becomes really intrusive and the risk is a lot higher. ... That becomes something I don’t trust as much yet” (Interview with Jay Upchurch).

Risk

Trust, not technical capability, gates how far automation can go

The industry is broadly capable of building agentic automation but hesitant to deploy it into consequential decisions, Upchurch says. “It’s easy to trust something that’s retrieving or querying and giving you back a result. ... It’s very different when you ask that agent to go beyond a query and now into action.” He identifies three layers organizations need before extending real autonomy to an agent:

• Defensible data quality and lineage
• Model governance and oversight
• Explainability, transparency, and fairness

Without maturity across all three, “you’re naturally going to move away from allowing that system to automate in an autonomous way” (Interview with Jay Upchurch).

Risk

Robots take your lunch money

RPA solutions offered no-code/low-code ways for nontechnical workers to automate their most tedious workflows before they could just tell Claude what to do. But those approaches also had fixed costs and didn’t include consumption metering. With IPA, nontechnical employees building workflow automations likely won’t be considering the token costs of their workflows – or if tapping into an LLM is even necessary – they will just build what works. Vendors that used to provide tools to enable fixed-cost automation will not be incentivized to put the pay-per-use automation tools in workers’ hands, and enterprise budgets could feel the pain as a result.

Examples /

Who’s already moving

Republic Airways builds governance before agentic takeoff

Republic Airways is deliberately holding back on agentic AI capabilities within Microsoft 365 Copilot until foundational data governance work is complete. That includes remediating overshared file links and deploying Microsoft Purview. CIO Matt Belanger draws a clear line between individual productivity AI tools and business process automation, which he says demands a different level of rigor before deployment: “The bigger opportunity space is around the transformation of the way we deliver value to the business. ... That does require significant governance.”

The CIO raises a point that will be common among companies in highly regulated industries. Aviation requires outcomes to be “provably correct,” he says, which sits uneasily against how AI actually works. “Given the non-deterministic nature of AI and the requirement to document all of our processes and have everything reviewed by the FAA and the TSA ... those things can come into conflict.” Audits happen on both ends of any automation project. “The audit happens at the end. And it also happens before you’re allowed to begin,” Belanger explains. “You make a proposal that is reviewed with the auditors that is modified, updated, whatever, then you go through the work, then you get reviewed on the outcome” (Interview with Matt Belanger).

Ikea fulfillment does more than just follow the instructions

Ikea’s parent company Ingka Group moved from manual fulfillment routing to a goal-based order allocation system based on AI. The system weighs more than 400 shipping points and selects the optimal route for each customer order. Outcomes include an improved cost ratio for shipping and logistics. One executive characterizes it as one of the retailer’s best automation investments so far (McKinsey & Company, 2026).

JPMorgan Chase pursues long-running autonomous agents

Asset manager JPMorgan Chase is moving its automation strategy beyond single-point automation to a model it describes as “digital workers.” New AI agents are expected to run for much longer, automating processes that take hours to complete or even longer. Derek Waldron, chief analytics officer at JPMorgan, says AI tools helped increase private banking sales by 20% and expects that bankers will cover 50% more clients with the technology (“JPMorgan Chase AI,” CNBC, 2026).

BNY expands its digital workforce

The Bank of New York Mellon spent $3.8 billion on technology in 2025 and a portion of that went to the salaries of 134 new digital employees (or AI agents) that are focused on specific repetitive tasks that people used to do. The bank assigns human managers to oversee the AI agents, doing work including coding and payment instruction validation. The agents have company logins and can communicate via email and Microsoft Teams (“Digital Employees,” CNBC, 2026).

Recommendations /

What leaders can do

1. Don’t rip out your RPA, but seek to augment it

   Organizations that have built working automation using RPA tools for tasks like data entry, transaction reconciliation, or exception handling shouldn’t seek to replace it with AI agents just for the sake of it. Deterministic tools can continue to handle those repetitive tasks requiring low judgment, making the most out of your investment rather than switching to a new model with consumption-based billing. But new IPA platforms can combine those RPA deployments with AI to automate more complex and multi-step processes. Resist vendor pressure to replace what’s already working, but do seek to leverage your RPA investments as part of your continued automation journey.

   “The action at the end, that last mile of automation, will largely continue to be the same,” Upchurch agrees. “There’s no reason to replace that automation. I would figure out different ways to call and trigger it where possible, especially if it’s known, tried, and trusted” (Interview with Jay Upchurch).

   
   Read more in Automate Work Faster and More Easily With Robotic Process Automation.

2. Get started with IPA

   To pursue intelligent automation, follow Infotech’s four-step guide to get started:
   1. Decide what should be automated, evaluating what will provide a high return on investment.
   2. Choose the right automation maturity. Will RPA do because you just need basic repetitive actions automated? Or are you aiming for an end-to-end process automation with many steps?
   3. Pick the right partner and product. Weigh your licensing options, what partners provide to support integration, and what product will deliver on your needs.
   4. Track progress toward your objectives. Measure and monitor the performance of your automation ecosystem using defined metrics.
   Read more in Empower Your Manufacturing Organization With the Potential of Intelligent Automation.

Bibliography /

Sources

1. “Automation Anywhere Unveils 2026 Platform Enhancements to Run AI-Driven Processes Across the Enterprise.” Automation Anywhere, 19 May 2026.
2. Bousquette, Isabelle. “Digital Workers Have Arrived in Banking.” The Wall Street Journal, 30 June 2025.
3. Fernandez, Ricardo. “UiPath: Can RPA and Agentic AI Coexist and Thrive? (Downgrade).” Seeking Alpha, 1 June 2026.
4. Parekh, Parag. “Elevating the Customer Experience: IKEA’s Agentic AI Journey.” McKinsey & Company, 11 June 2026.
5. Picker, Leslie. “Digital Employees, AI Bootcamps: America’s Oldest Bank Is Spending Billions on Tech.” CNBC, 9 Feb. 2026.
6. Pokora, Yana. “RPA Reloaded: 50+ Robotic Process Automation Statistics to Know in 2026.” Flobotics, 24 June 2026.
7. Shukla, Shreyas. “Empower Your Manufacturing Organization With the Potential of Intelligent Automation.” Infotech, 20 Dec. 2023.
8. Son, Hugh. “JPMorgan Chase AI: Bank to Deploy More Powerful Agents This Year.” CNBC, 9 June 2026.
9. “SS&C Unveils WorkHQ to Power Enterprise Agentic Automation.” SS&C Technologies, 29 April 2026.

Timeline sources

1. “Agentic AI Summit.” UiPath, 2025. Accessed 31 Aug. 2026.
2. “Automation Anywhere Secures Leadership in Agentic Process Automation, Posts Fifth Consecutive Quarter of Profitable and YoY Growth.” Automation Anywhere, 17 Dec. 2024. Accessed 31 Aug. 2026.
3. “Automation Anywhere Unveils 2026 Platform Enhancements to Run AI-Driven Processes Across the Enterprise.” Automation Anywhere, 19 May 2026. Accessed 31 Aug. 2026.
4. “Automation Anywhere Unveils Agentic Solutions, Delivering Outcome-Oriented AI for Business Users.” Automation Anywhere, 18 June 2025. Accessed 31 Aug. 2026.
5. Kuruganti, Adi. “From RPA to APA: The Future of Automation Is Agentic.” Automation Anywhere Community, 28 March 2025. Accessed 31 Aug. 2026.
6. “SS&C Unveils WorkHQ to Power Enterprise Agentic Automation.” SS&C Technologies, 29 April 2026. Accessed 31 Aug. 2026.
7. “UiPath Launches Agentic AI Solutions to Break Administrative & Financial Bottlenecks for Clinicians and Healthcare Admins.” UiPath, 23 Feb. 2026. Accessed 31 Aug. 2026.
8. “UiPath Launches Agentic Solutions to Strengthen Fraud Prevention and Accelerate Lending.” UiPath, 25 March 2026. Accessed 31 Aug. 2026.
9. “UiPath Launches the First Enterprise-Grade Platform for Agentic Automation.” UiPath, 30 April 2025. Accessed 31 Aug. 2026.
10. “UiPath Optimizes Retail and Manufacturing Operations with New Agentic Solutions.” UiPath Investor Relations, 25 March 2026. Accessed 31 Aug. 2026.
11. “UiPath Unveils New Vision for the Future: Expanding the Boundaries of AI with Agentic Automation.” UiPath, 22 Oct. 2024. Accessed 31 Aug. 2026.

Trend 1.3

AI Makes All Vulnerabilities Zero-Day

Generative and agentic AI are being adopted by hackers to detect vulnerabilities and automatically exploit them, bringing down the time to exploit from weeks to hours. Cyber defenders are using AI to fix their code, monitor for incursions, and red-team vendor solutions. Open source software is particularly exposed, threatening the software supply chain and requiring a new approach to vulnerability management.

Signals /

What we’re seeing

When “Patch Tuesday” becomes “patch yesterday”

Last year we cautioned that AI was being adopted by cybercriminals and cybersecurity professionals alike, accelerating the cyber arms race to machine speed. AI agents increase the rate of attacks launched against organizations and improve the average sophistication level of hackers. To defend against that surge, AI is being used to automate monitoring and remediation activities across security layers.

The trend continued to accelerate in 2026.

Every year, attackers move faster and threaten to exploit bugs before the patch cycle can catch them. AI now amplifies that trend, as LLMs can now find vulnerabilities at scale, so the constraint on security is shifting from discovery to the human capacity to verify, disclose, and patch what AI finds (“Project Glasswing: An Initial Update,” Anthropic, 2026).

Adversaries are moving more quickly to both weaponize zero-day vulnerabilities and exploit targets before they have time to apply issued patches.

The average time to exploit for newly discovered vulnerabilities is falling, while the average time taken to patch exploits is increasing.

Two sources of tracking time to exploitation agree the trend is accelerating downward, with Flashpoint and Mandiant examining different sets of vulnerabilities. Flashpoint measures the time it takes from a vulnerability’s disclosure to its first observed exploitation. Its measure of 44 days in 2025 shows how quickly adversaries are turning vulnerability disclosures into weapons. Mandiant measures the time it takes to exploit a vulnerability after a patch is released. Mandiant’s -1 number in 2025 reflects that vulnerabilities are now being exploited by hackers before defenders can apply the issued patches.

Average time to exploit is falling faster than patch cycles can respond

*Mandiant data reflects year reported, analyzing prior period’s data.

**Verizon’s data on median days to patch started tracking in 2024.

AI automates vulnerability detection

November 2025: Anthropic discloses the first documented large-scale cyber espionage campaign run primarily as an AI agent workflow. The state-run operation targeted 30 organizations across multiple sectors with several confirmed breaches. The attackers used Anthropic’s Claude Code to orchestrate the intrusion. They avoided Anthropic’s guardrails by posing as a legitimate security team hired to do penetration testing by clients. Anthropic banned the accounts to end the campaign, but the learning was clear – cyber espionage can now be automated (FTSG, 2026).

April 2026: Anthropic announces Glasswing, an initiative bringing together technology providers to secure critical software against its new Claude Mythos frontier model that is highly capable of finding and exploiting software vulnerabilities (“Project Glasswing,” Anthropic, 2026).

Mythos isn’t the only threat. The UK AI Security Institute found that OpenAI’s GPT-5.5 model was comparable in detecting vulnerabilities. Aisle Cybersecurity was able to reproduce Anthropic’s published results with smaller and cheaper open-weight models (Schneier on Security, 2026).

Organizations had 50% more critical vulnerabilities to patch this year compared to the previous year, found Verizon’s Data Breach Investigations Report. Overall, the time to patch a vulnerability before it’s exploited has been reduced from days to mere hours (Verizon, 2026).

Security researcher Bruce Schneier says the industry needs to respond to this new reality with some continuous improvement principles from DevOps. “You have an automated discoverer running against your network at all times, and if you’re building software, it becomes part of the nightly build, working through issues and fixing them. Bug-finding becomes a continuous part of the process.” He points to Microsoft as an early, visible sign of the strain this puts on legacy patch cycles. “Microsoft is now patching hundreds of holes a month on Patch Tuesday because the rate of discovery has increased by an order of magnitude” (Schneier on Security, 2026).

Open source becomes the front line

Open source code is most exposed to AI-driven vulnerability discovery and is pervasive in the software supply chain. Cybersecurity vendor and Project Glasswing partner Black Duck did an audit of commercial code bases and found open source components in almost all of them. It found that open source vulnerabilities per code base had more than doubled year over year, and almost 9 in 10 codebases included at least one vulnerability. Enterprises are at risk when internal developers use these code bases in custom applications and when vendors bundle the code inside the solutions they offer (Black Duck, 2026).

AI finds open source flaws faster than they can be fixed

Anthropic reports that a high- or critical-severity bug found by Mythos Preview takes about two weeks to patch on average and that some maintainers have asked it to slow its disclosures because they need more time to design patches (“Project Glasswing: An Initial Update,” Anthropic, 2026). The maintainers of curl, a widely used open source data transfer library, stopped accepting vulnerability reports for the month of July 2026 after what lead maintainer Daniel Stenberg described as four months of heavy pressure (Stenberg, 2026).

The industry is organizing around that remediation gap. In June 2026, the Linux Foundation launched Akrites, backed by founding members including AWS, Anthropic, Google, Microsoft and GitHub, OpenAI, Red Hat, Sonatype, Citi, and JPMorgan Chase. It runs a shared security incident response team and a single coordinated disclosure process, so maintainers receive one validated report instead of duplicates from many companies (Linux Foundation, 2026). It also aims to act as a maintainer of last resort for packages that are no longer maintained (SecurityWeek, 2026).

Implications /

What it changes

Opportunity

Triage with AI

CISOs can shift from playing catch-up with the latest zero-day exploits to a more proactive approach. While hackers can use AI to scan for vulnerabilities and then automatically exploit them, defenders have access to the same technology. LLMs can be used to identify vulnerabilities in code before it’s deployed or find vulnerabilities embedded in the software supply chain. AI can improve environment monitoring capabilities, triaging intrusions and remediating them.

Opportunity

Upgrade your vendor cyber risk assessment

The manual patch and respond method of security is dead, but the more urgent shift is upstream. Third-party and vendor risk management now matters as much as, or more than, an organization’s own security posture, because attackers will exploit whichever vendor in the chain is weakest, regardless of how strong internal defenses are. Some vendors will get access to the best frontier models to detect vulnerabilities, others won’t, and organizations inherit that gap the moment they depend on a weaker vendor’s code.

Opportunity

Make all your code disposable

What if it didn’t matter that your code contained vulnerabilities because the software was replaced so often that the exposure window disappeared? It’s an observation Schneier makes about the disposable and short-lived AI-generated code that is more often entering production. “Changing software is now cheap. You run an AI, it writes software all the time, then throws it away. ... So you might have vulnerabilities in there, but they’re not exposed for very long because you’ve already disposed of the code, and it’s really only affecting one person” (Interview with Bruce Schneier).

Risk

New attack economics make smaller targets more appealing

Even smaller organizations now face sophisticated cyber threats. AI capabilities have uplifted amateur cybercriminals to execute much more effective attacks than were previously possible. Small to mid-sized organizations must raise their level of cyber defenses to meet a persistent and sophisticated threat.

Risk

Some hardware can’t be patched

Unpatchable devices need a different defense model entirely. Some categories of hardware, home and small-office routers being the clearest example, will never realistically receive timely patches regardless of how fast vulnerabilities are found. Schneier expects these devices will need to be defended at the network level instead: “My guess is we’ll end up with some kind of supercharged intrusion detection and prevention system wrapped around legacy networks, defending against these vulnerabilities being exploited because they simply can’t be patched” (Interview with Bruce Schneier).

Risk

Open source flaws you can’t patch yourself

When a vulnerability surfaces in an open source library that an enterprise’s own developers use, it’s a simple matter to update and redeploy. When the same library is bundled inside a vendor’s packaged application, the enterprise must wait for that vendor to ship an update and remain exposed until the vendor responds. Stale dependencies stretch that window further. Black Duck found that 92% of audited codebases contained open source components four or more years out of date, and 93% contained components with no development activity in at least two years. Some of the flaws AI surfaces in that code may never get an upstream fix at all (Black Duck, 2026).

Examples /

Who’s already moving

Defenders adopt AI to fight back

Anthropic’s Project Glasswing aimed to provide players in the software supply chain with access to Mythos so they could use it to find and repair vulnerabilities in their code before cyber adversaries could access it. Anthropic initially partnered with Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, Nvidia, Palo Alto Networks, and 40 additional software makers to secure first-party and open-source systems. Anthropic provided its partners with access to its Mythos model while releasing a guardrailed version of it, Fable, for public use. Anthropic then extended the program to about 150 new organizations across 15 countries and multiple sectors (TechCrunch, 2026).

Mozilla’s Firefox team, which maintains one of the most widely used open source web browsers, got access to Mythos and applied it to the web browser. It followed up the evaluation with a patch for 271 vulnerabilities. “For a hardened target, just one such bug would have been red-alert in 2025, and so many at once makes you stop to wonder whether it’s even possible to keep up,” wrote a member of the team. “Our experience is a hopeful one for teams who shake off the vertigo and get to work. You may need to reprioritize everything else to bring relentless and single-minded focus to the task, but there is light at the end of the tunnel” (Mozilla Distilled, 2026).

Recommendations /

What leaders can do

Defend smarter and defend faster. Move upstream from the point of breach and build proactive, preemptive, and corrective practices. At the same time, transform security operations into a continuous, autonomous engineered system.

Demand more from vendors that have historically released flawed code and required users to deploy patches to fix it after the fact. Patch Tuesday isn’t going away, but it can no longer stand alone as a security model. Vendors should be held to account to release secure products, and organizations must pair that accountability with continuous, automated red-teaming that tests for weaknesses on an iterative basis rather than a fixed schedule.

Organizations should treat cybersecurity as a board-level priority. Boards should pursue a resilience-by-design strategy that guarantees critical systems will continue to function even when other components fail due to AI-driven attacks. Evaluation of vendors must include a cybersecurity review and be conducted regularly, not just at point of procurement.

Bibliography /

Sources

1. “2026 Data Breach Investigations Report.” Verizon, 19 May 2026.
2. “2026 Open Source Security and Risk Analysis (OSSRA) Report.” Black Duck, 25 Feb. 2026.
3. Badhwar, Varun. “Open Source Carries the World. Patching It at Mythos-Scale Can’t Fall to Maintainers Alone.” Endor Labs, 25 June 2026.
4. Bellan, Rebecca. “Anthropic Scales Claude Mythos to Critical Infrastructure in 15+ Countries.” TechCrunch, 2 June 2026.
5. “Claude Fable 5 and Claude Mythos 5.” Anthropic, 9 June 2026.
6. “Convergence Outlook 2026.” Future Today Strategy Group (FTSG), 2026.
7. European Union. “Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on Horizontal Cybersecurity Requirements for Products with Digital Elements (Cyber Resilience Act).” Official Journal of the European Union, 20 Nov. 2024, eur-lex.europa.eu/eli/reg/2024/2847/oj.
8. Holley, Bobby. “The Zero-Days Are Numbered.” Mozilla Distilled, 21 April 2026.
9. “Linux Foundation and Industry Leaders Launch Akrites to Defend Critical Open Source Software Against AI-Enabled Cyber Threats.” Linux Foundation, 25 June 2026.
10. “Linux Foundation Unveils New Open Source Security Project Akrites.” SecurityWeek, 26 June 2026.
11. Kutscher, Jurgen. “M-Trends 2026: Data, Insights, and Strategies From the Frontlines.” Mandiant, Google Cloud, 23 March 2026.
12. McCluskey, Curtis. “Preparing for the EU Cyber Resilience Act: Key Reporting Obligations From 11 September 2026.” Goodwin, 11 Sept. 2026.
13. “N-Day Vulnerability Trends: The Shrinking Window of Exposure and the Rise of ‘Turn-Key’ Exploitation.” Flashpoint, 17 Feb. 2026.
14. “Project Glasswing.” Anthropic, 7 April 2026.
15. “Project Glasswing: An Initial Update.” Anthropic, 22 May 2026.
16. Schneier, Bruce. “How Dangerous Is Anthropic’s Mythos AI?” Schneier on Security, 14 May 2026.
17. Stenberg, Daniel. “Curl Summer of Bliss.” Daniel Stenberg, 15 June 2026.

Trend 1.4

Tokenomics: Unpredictable AI Costs Cause a Budget Reckoning

The costs of consuming and training AI are unpredictable, challenging established enterprise cloud cost controls. A new discipline of agentic FinOps is needed to adapt.

Signals /

What we’re seeing

AI costs soar, adding to existing stack fees

The cost of using AI to do work is quickly getting more expensive. Ramp, a financial software vendor, reports that AI spend has increased 400% year over year between February 2025 and February 2026, according to its transaction data (Ramp, 2026).

That 4x increase looks tame compared to EY’s assessment of the impact of moving from AI chat-based interactions to agentic AI workflows in customer service. The average cost per task skyrocketed 30x from just $0.04 per task in 2023 to $1.20 in 2026 (EY, 2026).

Enterprises are accustomed to SaaS-based business models that provide access to software at a predictable monthly flat fee. The costs scale with the number of users. But AI-driven services are being metered based on consumption. Every token used is counted and put toward the final bill. Inexpensive chatbots turned into orchestrated agent workflows with attached tools and integration layers, loop refinements, and guardrails. The costs of automating workflows rose even as the demand went up. Not only are costs soaring upwards, but they are impossible to predict.

AI token costs vary per task based on what model is called, what tool calls it, and what pre-existing contract is made between the client and the vendor. Even what tasks require tokens to complete vs. being covered under an umbrella license can be hard to define. It’s no wonder that 80% of companies are missing their AI spend forecasts by 25% or more (Mavvrik, 2025) and 78% of IT leaders report unexpected changes to their SaaS budgets related to AI changes (Zylo, 2026).

Even where AI capabilities are made available through a subscription add-on, the costs add up quickly. A Ramp pricing calculator that considers an enterprise of 2,500 employees using just the Microsoft Copilot and Salesforce Agentforce add-ons estimates an AI surcharge of $940,500 annually – assuming adoption of the AI tools is only partial (Ramp, 2026).

Most vendors offering AI tools are now charging consumption costs for at least some features on top of their subscription billing. Microsoft is just one example, introducing hybrid billing about halfway through 2026 to GitHub Copilot and Microsoft Copilot and asking users to buy and spend credits for consumption of AI tokens.

FinOps to the rescue?

FinOps practices have taken on the burden of managing AI spend, with almost all practitioners saying it’s been added to their mandate in 2026.

Share of FinOps practices managing AI spend, 2024-2026

(FinOps Foundation, 2026)

Yet the practitioners face a number of challenges in trying to control AI spend effectively. More than half say it’s difficult to understand the full scope of AI spending, and four in ten say it’s hard to quantify the value of AI spend. Allocation, lack of strategy, and FinOps literacy round out the top five challenges reported by professionals.

Top challenges respondents face when applying FinOps practices to AI spend

(FinOps Foundation, 2026)

SAS CIO Jay Upchurch explains the underlying problem as vendors effectively controlling a new form of currency. “They’ve almost created their own currency with these tokens, and now they’re changing the value of that all the way through. So we’re playing a little bit of a guessing game” (Interview with Jay Upchurch).

The cost of agentic AI is more likely to continue to rise than it is to fall. As frontier AI model makers push for more compute resources to unlock better capability, training costs to produce the models have exploded. The amount of compute used to train frontier language models has grown exponentially since 2020, and costs have grown along with it. Training costs increased 3.5x per year since 2020, from about $2 million for GPT-3 to nearly $390 million for the largest training runs in 2024 (Epoch AI).

The higher costs to produce cutting-edge frontier models will be passed on to customers in the form of token costs. Learning how to manage token spend becomes the burden of the CIO.

Martin Bazinet, Director of Technology at AWS Canada, says the current cost unpredictability resembles the transition to cloud and the pain is temporary. “I think it’s the same as when we initially moved to cloud. There was that challenge of understanding what the costs were going to be associated with this. And then we started to have more of a FinOps approach and optimization for the right use case.” He expects the same maturation curve to play out with agentic AI and the emerging discipline of AI FinOps (Interview with Martin Bazinet).

Implications /

What it changes

Opportunity

Move from in-the-loop to on-the-loop

Governance advice for AI workflows has long been to put a human “in the loop” and give them the opportunity to review and approve actions suggested by AI. In practice, this approach has its limits, as AI can move quickly and queue up many approvals for humans to make. The people trying to keep up can quickly get burned out and falter in their judgements. With a “human on the loop” approach, humans define what authority AI has to take action. By setting the boundaries, humans allow AI to act autonomously until an exception comes up that requires human judgment. This can steer toward optimized financial outcomes as well as having other governance utility (Sherif, 2026).

Opportunity

Start selling AI FinOps solutions and services

If your organization can figure out how to get token-level cost visibility for agentic workflows, not only will it open the door to strategic decision-making on what tasks are worth automating, but it could become a new business venture. AI-specific cost attribution is a new capability within the FinOps and cloud cost management solutions market. Vendors are offering token-level spend tracking across the major AI platforms in a new category that’s emerged in the last two years. With many vendors to choose from, enterprises are also in a better position to buy such a capability. Competition between vendors including CloudZero, Amnic, Vantage, Finout, PointFive, Cloudgov, and Cloudchipr provides choice. The market for cloud FinOps is expected to grow from $14.9 billion in 2025 to $26.9 billion in 2030 (MarketsandMarkets, 2026).

Bazinet points to task-based model routing as one concrete lever already emerging in tooling. Amazon Kiro is a coding tool that selects between different underlying models based on task complexity rather than defaulting to the most capable (and most expensive) option. “You don’t always need [a frontier-class model] to process everything you’re building into software,” he says. “If you need to add comments into your code, maybe a very light model is going to be sufficient” (Interview with Martin Bazinet).

Opportunity

Showback before you chargeback

“Don’t make AI cost punitive; make it visible. Use showback models to assign usage accountability without enforcing chargeback before stakeholders are ready. In FinOps the concept of ‘informed ignoring’ is a related concept where the organization builds awareness around suboptimal spend buckets but focuses first on higher priority issues while these meters are running. Employing showback is a precursor activity that allows for education, planning, and eventual chargeback to the relevant stakeholders in a controlled and thoughtful manner, fostering AI cost management maturity.”

(Bickley, 2025)

Risk

The gap between monitoring and billing is growing

The pace of financial decisions is accelerating as AI consumption economics mean cost events happen continuously rather than in predictable cycles. The trend started with cloud computing but is scaling with agentic AI. As the FinOps Foundation summarizes: “Identification of anomalies using [cloud] billing details can be delayed as much as 36 hours from the start of the event and upwards of 24 hours before they are processed and made available for analysis” (qtd. in Sherif, 2026).

Risk

Unpredictable costs become an automation barrier

Even if organizations are able to automate new tasks through agentic AI today and show it provides return on investment, the unpredictable nature of token costs means that might not hold true next month or next year. An organization may be more comfortable sticking with a manual approach of people completing tasks directly. Even if they’re slower, at least their salary is in the control of the organization. Seeing a pre-purchased reserve of tokens burn up ahead of schedule or seeing tokens purchased on demand go up in price is a risk that organizations have to weigh when committing to agentic workflows.

Technology futurist Thornton May points to a specific and avoidable driver of budget shock – enterprise-wide license rollouts made without usage governance. “CFOs are getting these massive bills because … well, when you put 10,000 seats of Copilot out there, what’s going to happen, right?” He says organizations need to actively manage what tasks get routed to AI rather than defaulting to it for everything. “How do you get people to consume AI non-toxically?” (Interview with Thornton May).

Examples /

Who’s already moving

Going open source for lower cost

Bug-catching startup Detail shifted 90% of its AI workload from Claude and Gemini to open source models, including custom models and GLM, a family of models developed in China. “Once we find something that is working well and engineers love, we find ways to make it cost effective,” said Dan Robinson, founder of Detail. “There’s really an embarrassment of riches right now coming out of the open source labs” (The Wall Street Journal, 2026).

Uber shocked by AI’s “surge pricing”

Uber initially encouraged its staff to compete in “tokenmaxxing” or try to place atop leaderboards ranking AI tool usage. But after reportedly burning through its annual budget for AI spend in just four months, it rethought its approach. Instead of racing to maximize usage, Uber capped its spend for agentic AI coding tools at $1,500 per tool per employee (Bloomberg, 2026).

Walmart “rolls back” caps on AI use

Walmart started limiting the number of AI tokens each employee can use with its internal AI agent “Code Puppy,” which helps non-technical users create spreadsheets and presentations. After adoption of Code Puppy skyrocketed, Walmart found some redundancies in employee use with certain prompts being used repeatedly. In some cases, a good old-fashioned search is still the preferred option (Modern Retail, 2026).

Recommendations /

What leaders can do

1. Implement AI cost governance

   Establish AI spend as a first-class cost center by pairing showback reporting (cost broken down by team, use case, and token consumption) with right-sized model selection. Replace static monthly budgets with continuous token-level forecasting and cross-functional governance that assigns named owners, spend thresholds, and real-time architectural guardrails. The goal is to achieve predictable, accountable AI spend that scales with demonstrated business value instead of raw token volume, reducing exposure to the budget shocks already surfacing at early adopters and freeing the savings for reinvestment in higher-value initiatives rather than absorbing runaway inference bills. Thornton May puts the burden on adept task-routing rather than blanket AI access. In addition to model selection, governance should be about deciding which tasks are appropriate for AI. Treating every workflow, including basic search, as a default AI use case is what produces unpredictable bills (Interview with Thornton May).

2. Take a declarative approach to AI cost governance

   Once you’ve established an AI cost center, put in place a declarative approach that adopts agentic FinOps to execute the control system. A declarative approach defines the desired end state, metrics, and outcomes, focusing on the criteria for success. In contrast, an imperative approach defines specific steps and commands that can be executed and focuses on tasks. In a declarative system, humans hold the authority and set the intent, and agents then observe, reason, and decide on how to best enforce the policy. Humans monitor the outcomes and intervene as needed.

3. Build an IT-owned AI spend intelligence layer

   Don’t bolt cost tracking onto existing FinOps or procurement teams as an added responsibility. Stand up a dedicated, IT-owned layer that runs three functions: Surface every dollar of AI spend across contracts, vendor invoices, credit cards, and shadow AI subscriptions finance doesn’t yet see; allocate that spend to the project, sponsor, and department generating it; then convert the resulting data into ROI findings leadership can act on. Treat this as a standing capability, not a one-time audit, so cost visibility keeps pace with the sprawl of new AI tools and usage patterns entering the enterprise (Clark, 2026).

Bibliography /

Sources

1. “The $1 Trillion AI Spend Blind Spot.” Ramp, 2026. Accessed 24 July 2026.
2. Alves, Angel, et al. “Managing Cloud cost Anomalies.” FinOps Foundation, 17 March 2026.
3. Bickley, Scott. “Gen AI Cost Forecasting for the Enterprise.” Infotech, 30 May 2025.
4. Christopher, Eric. “How Is Your Organization Allocating IT Budgets for SaaS Spend?” Zylo, 19 Sept. 2024.
5. Clark, Brian. “Tokenomics.” Texas AI Day. Texas Department of Information Resources, 28 July 2026, Austin, Texas.
6. “Data on AI Models.” Epoch AI. Accessed 24 July 2026.
7. “State of FinOps 2026 Report.” FinOps Foundation, 2026. Accessed 28 Aug. 2026.
8. Lung, Natalie. “Uber Caps Usage of AI Tools Like Claude Code to Cut Costs.” Bloomberg, June 2, 2026.
9. “Cloud FinOps Market Report 2025-2030, By Applications, Geo, Tech.” MarketsandMarkets, Jan. 2026.
10. Olson, Bradley. “The AI Price War Is Here, Piling Pressure on OpenAI and Anthropic.” The Wall Street Journal, 11 June 2026.
11. Parton, Mitchell. “Walmart Executives See the Promise of AI, but Also the Costs.” Modern Retail, 4 June 2026.
12. Sherif, Nabeel. “Optimize Cloud & AI Spend With Agentic FinOps.” Infotech, 9 June 2026.
13. Smith, Shawn, et al. “Unlocking Agentic Value: A New Investment Discipline for the Agentic Era.” EY, 1 June 2026.
14. Tishgart, Lindsey. “AI Cost Management Research: 85% of Companies miss AI forecasts by 10%.” Mavvrik, 10 Sept. 2025.