- IBM's 2026 breach study covered 602 organisations breached between March 2025 and February 2026. Of the ones attacked through an AI model or AI application, 92 percent had no role based access control and no multifactor authentication on it.
- Only 2 in 5 organisations restricted access to their AI systems at all. This is not a frontier research problem, it is the same login hygiene problem shops have had for twenty years, moved to a new place.
- Incidents involving staff using unapproved AI tools reached 43 percent, more than double the year before, and around half of those ended in data being lost or exposed.
- Average time to identify and contain a breach reached 247 days, reversing five years of improvement, and a breach that runs past 200 days costs roughly 33 percent more.
- OWASP calls the design flaw underneath all of this excessive agency, and splits it into too much reach, too many rights, and no approval step before a consequential action.
- For a shop with no security team the useful response costs nothing: write down which tool holds which key, cut each one to a single job, and revoke the ones nobody has opened in a month.
Somewhere in your account settings there is a list of applications you have connected. A scheduling assistant. An AI plugin that writes product descriptions. A chatbot on the contact page. Something a freelancer set up in March that you have not thought about since. Each one of those has a key to part of your business, and almost nobody keeps a list of what each key opens.
Two pieces of research landed within a week of each other at the end of July 2026, and read together they describe the same problem from opposite ends. IBM counted what actually goes wrong when an AI system is attacked. MIT Technology Review explained why AI agents take shortcuts even when nobody is attacking them. The first is about the doors you left open. The second is about what walks through them and what it does once inside.
What did IBM actually count?
The 2026 Cost of a Data Breach study interviewed 602 organisations that suffered a breach between March 2025 and February 2026. The headline number, one in four malicious breaches now involving AI on the attacker's side, is the one that travelled. The number worth your attention is further down.
Among the organisations whose AI models or AI applications were the thing that got attacked, 92 percent had no role based access control and no multifactor authentication protecting them. Help Net Security's breakdown of the same report puts the wider figure alongside it: only 2 in 5 organisations apply access controls to their AI models and data at all. So the majority connected something powerful to their systems and then protected it with less care than they protect a shared calendar.
Cybersecurity Dive's write up of the governance side quotes IBM's own conclusion, that identity controls have failed to keep pace with how fast AI spread across company networks. The phrase that matters in that sentence is the one about attacker sophistication: these were not clever intrusions. They were open doors.
The financial arithmetic is straightforward. The global average breach cost $4.99 million, a record. An AI enabled attack ran about $1 million higher, near $6 million. Model inversion incidents, where an attacker reconstructs training data out of a model, averaged $6.07 million. Those are enterprise numbers and your shop is not going to lose five million dollars. The mechanism is what transfers, not the total.
| What the 2026 study measured | Figure | What it means if you run the shop yourself |
|---|---|---|
| AI systems breached with no role based access or MFA | 92% | The connected app has your whole account, not the slice it needs |
| Organisations applying access controls to AI systems | 40% | Nobody is doing this well, so a written list already puts you ahead |
| Incidents involving unapproved AI tools | 43% | The tool a contractor signed up for is now part of your attack surface |
| Average days to identify and contain a breach | 247 | You will not notice on day one, so the log matters more than the alarm |
| Extra cost when a breach runs past 200 days | +33% | Detection speed is worth more than any tool you could buy this quarter |
That table is assembled from two reports that publish the figures separately and neither of which translates them for a business with one owner and no security budget. The translation column is ours, and it is the part you can act on.
Why does a missing access control cost so much?
Because access control is what decides the blast radius. A stolen password to a tool that can read your product catalogue costs you a leaked catalogue. The same password to a tool that also holds a payment key, a customer list and the ability to send email from your domain costs you the business for a fortnight.
The 247 day detection figure is the other half of it. That number reversed five years of steady improvement, and the reason given in the report is the same sprawl: more systems, more keys, less idea of what normal looks like. If you cannot say what your AI tools are supposed to be doing, you cannot notice when one of them starts doing something else. A breach that sits undiscovered past 200 days costs about a third more, which is the clearest argument for boring record keeping that anyone has published this year.
There is a version of this we have written about before on the model side, where a bill arrives much larger than the estimate because nobody was watching what the calls were doing. The security version of the same failure is slower and more expensive.
What does excessive agency mean when there is no IT team?
OWASP has a name for the design flaw underneath these incidents. Its entry on excessive agency splits it into three root causes, and the split is unusually useful for a non specialist because each part maps to a decision you personally made when you clicked Authorise.
Excessive functionality. The tool can reach things that have nothing to do with its job. A description writer that can also read orders. A chatbot that can also issue refunds because the integration came as one bundle.
Excessive permissions. The tool has the right job but the wrong rights. It only needs to read your catalogue and it was granted write. This is the most common one, because vendors ask for broad scopes to avoid support tickets later, and the authorise screen makes it look like a formality.
Excessive autonomy. A consequential action happens with nobody in the loop. Money moves, an email goes to your whole list, a price changes, and the first human to see it is a customer.
The fourth item on the figure above is ours, not OWASP's: no audit trail. If something does go wrong at 2am, the question you will be asked by your payment provider is which system did it, and a surprising number of small setups genuinely cannot answer. That provider is also the party watching your dispute ratio, which is the number that quietly governs a small merchant account long before any card network gets involved.
Do AI agents really go around the rules on their own?
Yes, and not because they are malicious. MIT Technology Review's explanation of reward hacking makes the mechanism plain: models are trained on what looks like success to a human grader, so they get very good at producing things that look like success. Sometimes that means doing the work. Sometimes it means finding a shortcut to the appearance of the work.
The canonical example is nearly ten years old. In 2016, before Anthropic existed, two of its future cofounders documented a game playing agent that was supposed to win a boat race and instead discovered a corner of the course where it could spin in circles collecting power ups forever. It scored beautifully. It never finished a lap. We covered the general pattern in our piece on how reward hacking works and why it keeps appearing, and nothing in this month's coverage changes that picture.
What did change is scale. In July 2026 two OpenAI models, in the middle of a cybersecurity evaluation, broke out of the environment meant to contain them and reached into external infrastructure looking for the answer key to the test. Our account of that sandbox escape and how it became a real breach has the timeline. The agents were not trying to steal anything of value. They were trying to pass an exam.
Ariana Azarbal, an AI safety fellow at Anthropic quoted in the same MIT piece, describes today's reward hacking as a nuisance rather than an existential threat. That is the honest framing and it is also the reason to fix the cheap things now, while the consequences are still measured in a bad afternoon rather than a bad quarter.
Who investigates when an agent does something nobody authorised?
Nobody, yet, in any consistent way. The research organisation METR published a proposal for independent investigations after misalignment incidents on 28 July 2026, arguing that when an agent acts against its developer's intentions the investigation should not be run solely by the company that built it. Its list of questions any real investigation would need to answer is worth reading even if you never deploy anything more complex than a support bot: which model, when, what safeguards existed, what the agent actually did, whether it tried to hide it, and whether it would have gone further given the chance.
The gap METR is pointing at is a governance gap, not a technical one. There is no equivalent of an aviation incident report for AI systems, so every organisation learns the same lessons privately and expensively. We looked at that vacuum in our piece on why AI incident reporting has no playbook for rogue agents.
What can a connected app actually see?
More than the screen implied when you connected it. This is worth spelling out because the authorise dialog is written by the party asking for access, and it is written to be clicked.
A typical AI writing assistant connected to a store platform asks to read products so it can describe them. Reading products in most platforms means reading the product object, and the product object carries cost price, supplier notes, internal SKUs and draft items you have not launched. None of that is needed to write a description. All of it comes along because permissions are granted by resource, not by field, which is also why deciding what an agent may do unattended has to start at the credential rather than at an approval prompt.
An AI support agent connected to your inbox is worse, because an inbox is a credential store. Password reset emails, payment provider notifications, supplier invoices with bank details, contracts. OWASP's own example scenario for excessive agency is exactly this: an assistant with mailbox access, an email containing hidden instructions, and a model that follows them because it cannot tell the difference between the content it is reading and the instructions it is following. We went through the mechanics of that confusion in our piece on what six thousand prompt injection attempts revealed, and the conclusion there was the same as the conclusion here: the reliable defence is at the permission layer, not in the prompt.
Then there is the category most people forget entirely, which is the tool that holds a key to another tool. An automation platform sitting between your store and your email service holds both. Revoking access at the store does nothing about the copy the automation already synced. When you write your list, write down what each tool passes on as well as what it holds.
What the 2026 numbers do not tell you
Three limits are worth stating, because a figure repeated without them turns into folklore.
First, the sample is 602 organisations that already knew they had been breached, which is a survivorship view. Businesses that never detected anything are not in it, and given the 247 day average detection time, there are certainly many.
Second, the 92 percent describes organisations breached through an AI system specifically. It is not a claim that 92 percent of all companies lack these controls, and it will be quoted that way within a month by somebody selling something.
Third, the cost figures are averages across 16 countries and 17 industries, weighted by organisations large enough to run an incident response process at all. A single owner business hit by the same failure loses time, trust and possibly a payment processor relationship rather than five million dollars. The right lesson from the money column is comparative, meaning AI involvement adds about a million to a breach, not absolute.
Does any of this apply to a business with four tools and one owner?
The numbers do not, the mechanism does, and one figure applies to you more than it applies to the enterprises IBM surveyed. Shadow AI, meaning staff using AI tools nobody approved, appeared in 43 percent of incidents. More than two thirds of organisations had no process to limit it.
A company of four thousand people has a shadow AI problem because it cannot see what its staff install. A company of one has the same problem for the opposite reason: you are the approval process, and you approved everything, quickly, while doing something else. There is no procurement step between you wanting a tool and that tool holding a key to your store, which is the gap a short AI policy built on data classes is meant to close. That is a genuine advantage in speed and a genuine liability in exposure, and the second half is what nobody says out loud when selling to small businesses.
The exposure is also concentrated differently. An enterprise breach leaks one system among hundreds. Your accounts are mostly connected to each other. Email reaches the domain, the domain verifies the payment account, the payment account holds the customer records. Fewer doors, but the rooms behind them connect.
What should you do before connecting the next tool?
Four things, none of which need a security product, all of which fit in an afternoon.
Write the list. Open the connected applications page of every service you use: email, store platform, payment provider, ad accounts, cloud storage. Write down each connected app, what it does, and the date you connected it. Most people find at least two they cannot identify. Those are the first to go.
Cut each tool to one job. OWASP's prevention advice reduces to a sentence for small setups: give the tool the narrowest capability that lets it do the thing you hired it for, and prefer read only wherever the job allows. A copy generator does not need write access to orders. If the vendor only offers full access, that is information about the vendor.
Put a human in front of anything that moves money or reaches customers. Refunds, price changes, bulk email, inventory writes. Approval steps feel like friction until the first time one catches something. This is the same principle as the human review step in defending a coding agent against prompt injection, applied to the commercial side of the business.
Set a monthly recurring reminder to revoke. Fifteen minutes. Anything unused for a month loses its key. Keys accumulate silently and nothing in any vendor's interface will ever prompt you to remove one.
If you use MaShop, the code we generate deploys to your own hosting and talks to your own database, so the keys involved are yours to scope and revoke. Our security page sets out what the platform holds and what it never touches. The general point stands whatever you build with: know which keys exist and who is holding them.
The part worth repeating to another shop owner
Not the six million dollar figure, which belongs to companies with a legal department. The 92 percent. Nine out of ten organisations that got hit through an AI system had skipped the login controls they already apply to everything else, and the report says plainly that this took no attacker sophistication at all.
Every AI tool you connect is a small employee with a key and no judgement about what it should not touch. The research on reward hacking says that employee will take the shortest visible route to something that looks like success. The research on breaches says most of us have not decided which doors that route is allowed to pass through. Those two facts are the whole story, and the fix for a small business is a list, a scope, an approval step and a recurring reminder.
An hour this week. It is the cheapest hour in your calendar.