Key takeaways
- The rise of the “AI power user”: Although AI has expanded across every business function, risk is heavily concentrated. A highly active group of power users are driving the vast majority of enterprise AI exposure.
- The dominance of “shadow AI”: Security teams are suffering from a severe visibility gap, focusing heavily on a few approved platforms while a massive “long tail” of unmanaged apps runs silently beneath the surface.
- The emergence of AI-native attack vectors: The new report details three novel threat methodologies discovered by researchers in 2026 that bypass traditional perimeter defenses entirely.
CAMBRIDGE, Mass., Aug. 05, 2026 (GLOBE NEWSWIRE) —
Akamai
(NASDAQ: AKAM) released a new State of the Internet (SOTI) security report today that details how rogue browser extensions and vulnerable autonomous agents are actively expanding the enterprise threat surface. The Enterprise AI Usage Risk Report 2026 reveals how decentralized shadow AI, highly active AI power users, and silent browser extensions are exposing critical corporate assets to entirely new classes of cyber risk.
The report tracks a profound shift in corporate AI adoption. What began in early 2025 as cautious experimentation has solidified into a structural mandate. However, this rapid integration has outpaced traditional security guardrails.
“AI is no longer just a productivity booster; it is a collaborative colleague with direct access to the corporate crown jewels,” said Or Eshed, Vice President, Enterprise Security Product and Engineering of Akamai. “Traditional data loss prevention tools were built for an era of file transfers and emails. Today, sensitive corporate data is being systematically fragmented across millions of fluid prompts, unmanaged personal accounts, and autonomous AI agents. Security leaders must pivot from trying to block AI to continuously governing how it operates at the interaction level.”
Emerging AI-native attack vectors
The report details three novel threat methodologies discovered by researchers in 2026 that bypass traditional perimeter defenses entirely.
- Vibe hacking: Attackers covertly manipulate local markdown instruction files within a developer’s environment. This subtle modification tricks frontier coding assistants into generating insecure outputs or executing unauthorized actions — mimicking a developer’s normal workflow.
- CursorJacking: Rogue browser extensions exploit broad permissions to silently harvest API keys, proprietary codebases, and conversational history directly from the browser environment. This is a high-impact exploit targeting popular AI coding assistants (like Cursor).
- CometJacking: By embedding malicious instructions on a public web page, attackers use indirect prompt injection to manipulate the user’s local AI agent. The compromised agent can then exfiltrate local files, emails, and session credentials without the user’s knowledge. This threat targets agentic browsers like Perplexity’s Comet AI.
The 2026 CISO roadmap to secure AI
To capture the economic benefits of AI without exposing critical data, Akamai’s report outlines five core mitigation strategies for modern CISOs.
- Target AI power users: Target telemetry, monitoring, and tailored coaching toward the 5% of high-risk employees who are driving the majority of interactive AI prompts.
- Eliminate shadow AI: Force single sign-on (SSO) federation across all platforms and continuously discover the long tail of niche AI software as a service (SaaS) tools.
- Inspect the interaction layer: Transition from static DLP to real-time, contextual analysis of prompts, copy/paste buffers, and document uploads.
- Vet browser and IDE extensions: Treat extensions as highly privileged software. Almost 75% of AI extensions demand high or critical permissions, and 16.3% contain known CVEs.
- Secure AI agents: Establish strict, least-privilege boundaries and behavioral monitoring for autonomous AI agents that act on behalf of employees.
Now in their 12th year, Akamai’s SOTI reports continue to offer critical insights on cybersecurity trends and web performance, drawn from attacks viewed across Akamai’s cybersecurity infrastructure, which handles a significant portion of global web traffic.
About Akamai
Akamai is the cybersecurity and cloud computing company that powers and protects business online. Our market-leading security solutions, superior threat intelligence, and global operations team provide defense in depth to safeguard enterprise data and applications everywhere. Akamai’s full-stack cloud computing solutions deliver performance and affordability on the world’s most distributed platform. Global enterprises trust Akamai to provide the industry-leading reliability, scale, and expertise they need to grow their business with confidence. Learn more at akamai.com and akamai.com/blog, or follow Akamai Technologies on X and LinkedIn.
Contacts
Akamai Media Relations
[email protected]
Akamai Investor Relations
[email protected]
