The Pulse
Microsoft Maps AI’s Expanding Cyberattack Surface
Microsoft’s 2026 Digital Defense Report says AI agents are adding new security risks as they connect to company data, applications and tools. The report outlines five areas to protect, from prompt manipulation to compromised agent identitie
AI.info Team · Written with AI ·
About 88% of enterprises are already experimenting with AI agents, Microsoft says, while 82% of business leaders plan broader rollouts within 12 to 18 months. Those deployments can give software agents access to company data, applications, APIs and tools—connections that help them work, but also create new routes for attackers.
Microsoft set out that risk in its 2026 Digital Defense Report, released October 1. The report treats AI as both a tool attackers can use against familiar targets and a system they can attack directly, from the data fed into a model to the infrastructure serving it and the outputs it produces.
Agents bring identities, data and tools into scope
AI agents do not operate in isolation. Their security depends on the identities they use, the permissions they receive, the information they can retrieve and the actions their connected tools allow. An agent granted excessive access could expose data or take actions beyond what its designers intended, even if the underlying model is functioning as designed.
Microsoft’s report groups agent risks into five areas: prompt and intent manipulation; sensitive-data exposure; identity and privilege compromise; excessive agency; and operational integrity. The recommended controls include inspecting prompts and outputs, limiting access to sensitive information, verifying agent identities, restricting available tools and keeping tamper-resistant logs.
Terrell Cox, Microsoft’s CVP and deputy CISO for its Customer Security Management Office, writes that agents “can interact with enterprise data, applications, APIs, and tools, with different levels of access and autonomy depending on how they are designed and deployed.” The report’s emphasis is on those connections, not just the model: a security review must account for the surrounding data, permissions, services and infrastructure.
AI gives attackers another target—and another tool
Microsoft describes a two-sided shift. Attackers can use AI for reconnaissance, social engineering, malware and exploit development, and activity after gaining access. They can also target AI components themselves, seeking to manipulate inputs, steal data, disrupt services or compromise the systems that run models.
The report cites a malicious browser extension Microsoft found in December 2025. It had more than 600,000 installs and collected conversation histories from ChatGPT and DeepSeek; Microsoft says the activity affected nearly 10,000 organizations before it was mitigated. The figure describes the extension’s installs, not a count of confirmed victims or stolen conversations.
AI tools can make familiar techniques faster or easier to tailor, but Microsoft says people, identities, exposed systems and trusted access remain prominent in the activity it observes. That framing matters: AI adds new ways to attack without replacing the established weaknesses attackers already exploit.
Rollout projections sharpen the access question
Microsoft reports that 82% of leaders plan broader agent rollouts within 12 to 18 months. It also cites an industry projection of roughly 1.3 billion AI agents in production by 2028; that is a forecast, not a Microsoft count of agents already deployed.
As agent numbers grow, organizations will need to track which identities each one uses, what data and tools it can reach, and how quickly access can be withdrawn. Microsoft’s recommendations include scoped credentials, least privilege, mutual authentication between agents, and ways to attribute actions to a specific agent.
Defenders face the same acceleration
AI can help security teams find weaknesses in software, combine signals from different systems and speed up routine investigation. Microsoft argues that automation can handle repeatable analysis, while experienced operators remain important for spotting undocumented attack paths and understanding how apparently unrelated weaknesses connect.
The report’s central security problem is practical: agents are moving into enterprise workflows faster than organizations can assume that their old identity and access controls cover them. Before a broader rollout, teams need an inventory of agent identities, permissions, connected tools and revocation paths—not just a list of the models they use.