By Cyber Security Briefing · Friday, September 18, 2026 · 4 min read

Agentic AI Is Creating New Attack Surfaces Faster Than Defenses Can Adapt

Original illustration created for Cyber Security Briefing.

Agentic AI Is Creating New Attack Surfaces Faster Than Defenses Can Adapt

Roughly $1 trillion of global cybersecurity infrastructure is too old to run at machine speed, Palo Alto Networks CEO Nikesh Arora said on CNBC's "Mad Money" on September 2, 2026. Arora told the network that legacy systems built seven to ten years ago cannot handle "AI at machine speed," and that the launch of Anthropic's Mythos model marked a turning point because it demonstrated an AI system's ability to autonomously find and exploit zero-day vulnerabilities, according to OODAloop's report on the interview.

"You cannot deploy AI successfully if you don't get cybersecurity right," Arora said, per OODAloop's September 2 account, naming rogue AI agents as a primary driver of new breaches.

The Black Hat evidence behind the warning

The clearest picture of what a hijacked agent can do predates Arora's warning by a year. Researchers from Zenity Labs demonstrated at Black Hat that widely used agents from Microsoft, Google and Salesforce could be hijacked through prompt injection, CFO Dive reported on August 11, 2025. Microsoft Copilot Studio agents were manipulated into leaking entire CRM databases; Salesforce's Einstein platform was rerouted to exfiltrate customer communications. Greg Zemlin of Zenity told CFO Dive that attackers can gain "memory persistence" in these agents, which he said allows for long-term operational disruption and data theft from enterprise data lakes.

Black Hat USA 2026 built on that finding rather than repeating it. Analysis from Noma Security, published August 11, 2026 by NHIMG, reframed the same hijacking risk in identity terms: agentic systems move from "observation to execution" inside a single execution window, which changes how identity and access management has to work. Practitioner guidance from that research called for "runtime controls that follow the agent" and for separating agent identities from human access paths, so that malicious actions cannot disappear into shared service accounts.

Where the risk actually sits

Zemlin's memory-persistence finding is the detail that changes how an incident gets scoped. A compromised Copilot Studio or Einstein deployment is not a one-time leak; it is a standing channel into whatever CRM or communications data that agent was ever granted access to, which is why the 2025 Zenity demonstrations targeted full database exfiltration rather than single records. A discrete breach and a standing channel do not carry the same remediation cost, and nothing in the Black Hat 2026 material suggests enterprises are pricing that difference yet.

Noma Security's identity argument points to the second place practitioners are being told to look: the boundary between agent identities and human access paths. Shared service accounts let malicious agent actions blend into normal traffic, which is the specific failure mode "runtime controls that follow the agent" are meant to close. An industry summary distributed by Ground News on September 4 used the term "least agency" for a related idea — identity-based access controls and deterministic guardrails applied to individual agents rather than the human account that provisioned them. Ground News did not name the underlying study behind its own growth figures, and no second outlet has reported them, so the term is worth noting; the numbers behind it are not.

The window keeps shrinking

The timelines practitioners are working against have compressed sharply, according to Palo Alto's own Unit 42 Global Incident Response Report 2026 — a report CIO cited on June 4 without stating when the underlying research was first published. Attackers now move from initial access to data exfiltration in as little as 72 minutes, four times faster than the prior year, and exploit scans begin within 15 minutes of a vulnerability disclosure, per that report.

Abhishek Singh, VP of Product Management, reported that AI-related breaches now affect 13% of organizations, with prompt-injection attempts surging 340% year-over-year. Singh's report argued that conventional tools fail because they cannot see "how a model or agent actually behaves at runtime." A fully patched system, the report noted, can still leak sensitive data through a single crafted prompt.

What Palo Alto's earnings say about the gap

Palo Alto's own quarterly numbers show where enterprise spending is actually landing, though the only account of them comes from a single trade outlet. The company reported fiscal Q4 2026 revenue of $3.41 billion, up 34%, driven by what Arora called its platformization strategy, MarketBeat reported on September 1. XSIAM, the company's AI-driven detection product, exceeded $700 million in ARR; Prisma AIRS, its AI runtime security line, surpassed $100 million.

Those figures show real budget moving toward the runtime-control approach that the Zenity and Noma research were describing.

What's still unresolved

Prisma AIRS crossing $100 million in ARR, per MarketBeat's September 1 report, shows demand for the runtime-security category. It does not show how much of that revenue reflects full deployments of agent-level identity separation versus pilots, and no figure in the reporting so far breaks that split out.

The Ground News growth figures carry the same limit: an aggregator citing an unnamed study is not a number a trading desk should build on, and it should stay out of any comparison with Palo Alto's own reported numbers until a second outlet confirms it.

Links Verified at Time of Publish.