Artificial intelligence has moved beyond experimentation. It now retrieves customer records, evaluates transactions, recommends business decisions, writes to enterprise systems, and invokes tools. Security and governance controls have not caught up.
IBM's 2026 Cost of a Data Breach Report (Ponemon Institute, n = 602 organizations, 17 industries, 16 countries, March 2025 – February 2026) found that breaches involving AI models and applications grew to 21% of all breaches studied, up from 13% last year — a 61% increase. Among organizations that experienced one, 92% lacked proper AI access controls.
Financial services is carrying a disproportionate share of that. The sector now has the second-highest average breach cost of any industry at $6.29 million, up from $5.56 million a year ago. It is also squarely in the path of the AI-driven wave: critical infrastructure absorbed 62% of all AI-driven attacks in the study, with financial services and energy the two most targeted sectors.
61%
Rise in breaches involving AI models or applications
92%
Lacked proper AI access controls
$6.07M
Average model-inversion breach cost
19%
Governance and security teams that coordinate
The problem
The workflow around AI is where it breaks — not the model
The more important finding is where many incidents began. IBM's researchers point to weaknesses in connected applications, APIs, access controls, cloud environments, and deployment configurations — not the model itself. This is the enterprise AI control gap.
Organizations often begin AI governance with an inventory of models and vendors. That's necessary, but it doesn't show how AI behaves once it's connected to enterprise data and operational systems.
User
Human or service
Identity
Auth and authority
Application
Business system
Enterprise data
Retrieved or provided
AI model
Inference and output
Agent or MCP tool
APIs and actions
Business action
Decision or transaction
Two control layers matter most. Where enterprise data reaches the model, and where an agent turns model output into a business action.
An employee may be authorized to view a customer record and separately authorized to use an AI assistant. That doesn't mean the employee should be permitted to send the entire record to every available model.
An agent may be authorized to use a customer-management tool, but it shouldn't be able to pull customer data without authorization, modify medical records, or evaluate confidential employee or private-company records outside the approved workflow.
Runtime risk
The costliest incidents target behavior, data, and integrations
Model inversion and prompt injection produced the highest average costs among the AI-related incident types IBM tracked this year — $6.07 million and $5.89 million respectively, both well above the $4.99 million global breach average. Cloud misconfiguration, malicious models, and model evasion also produced substantial losses.
The costliest AI-related breaches are runtime attacks
Average cost per breach (USD millions)
Prompt injection illustrates why AI governance can't end with a vendor assessment or a pre-deployment review. The attack happens while the system is operating.
A malicious instruction may try to override application rules, retrieve restricted information, or manipulate an agent into invoking a tool. The useful defense isn't limited to detecting suspicious language — it also restricts what the AI can access and what actions it can take if manipulation succeeds.
When the agent picks the attack surface itself
A campaign reported this summer shows how quickly this stops being theoretical. Security researchers at Island documented roughly 7,600 malicious GitHub repositories — more than 800 of them posing as AI Skills or MCP servers, with around 600 listings placed across public MCP and Skill registries. The repositories delivered a loader that installs an information stealer targeting credentials, cookies, and active sessions.
The delivery mechanism is what matters for governance. No one has to click a malicious link. An agent looking for a capability can find one of these repositories on its own, read the attacker's README as if it were documentation, and hand the installation instructions to its user. In the researchers' testing, one coding agent followed an MCP marketplace to two malicious repositories unprompted; another returned a malicious server as its first recommendation.
Their recommended defenses are governance controls, not detection tooling: keep a curated catalog of reviewed Skills, MCP servers, and plugins; hold an inventory of every AI capability in use with its source and version; and monitor the paths agents use, not only the paths people use.
That reframes the problem. If an agent can adopt a capability nobody approved, then the approved set of tools is a control surface — and any tool appearing outside it is a governance event, whether or not it turns out to be malicious.
Existing controls see only part of the workflow
Identity platforms, data loss prevention, API gateways, cloud security, and security information systems remain essential. But each one sees only part of the AI workflow.
An API gateway can authenticate the request, but it doesn't decide which MCP tools an agent may call, which arguments are allowed, or whether the action requires human approval.
A logging system can record the event, but it may not capture which policy applied, why the call was allowed or blocked, or whether sensitive data was removed.
Business impact
The impact is financial and operational, not just technical
More than half of organizations that experienced an AI-related breach reported financial loss. Operational disruption and unauthorized access to sensitive data were nearly as common.
AI-related breaches hit the balance sheet first
Share of organizations reporting each impact
That distribution matches the broader pattern this year's report describes: identity and access management is one of the most effective cost reducers across all breaches, yet 92% of AI-related breaches happened without it in place. Access controls, not model selection, are the load-bearing gap.
What to do
What business leaders should do now
Business leaders need continuous runtime verification, stronger controls for human and non-human identities, secure external integrations, and visibility into how data enters, changes within, and exits AI systems.
- Map AI-enabled workflows, not only models. Document the user, application, data, model, agent, tool, and business action involved in each important use case.
- Extend authorization to data and actions. Define who or what may use each model, retrieve each data category, and invoke each tool for a stated purpose.
- Enforce policies while the workflow is running. Block, redact, constrain, or escalate risky requests before they reach the model or execute through a tool.
- Give governance and security the same operational record. Connect the policy, the runtime decision, the enforcement action, and the resulting evidence — only 19% of organizations report the two functions coordinate today.
- Prepare to reconstruct the full incident. Preserve the identity, data, prompt, model, tool call, policy decision, and business outcome as one trace.
Where we fit
Where Meilynx fits
Where Meilynx helps. Agents and tools, under the same audit chain. Meilynx traces full agent execution — retries, tool calls, sub-agent invocations — and enforces tool allow/deny at the proxy boundary, so every agent action lands in the same examination-ready audit trail as a plain LLM call. It detects when agents drift from their approved baseline — system prompts, tool grants — and gates high-risk actions behind fresh two-party approval, evidenced in the same chain. Drift detection evaluates observed traffic at the data plane, from hashes; raw material never crosses the trust boundary.
That is the control the campaign above argues for. A tool outside the approved set is flagged when it appears in traffic, and a consequential action waits for a second person — with both the finding and the decision recorded rather than reconstructed later.
These rules map to named framework controls — model monitoring under the SR 11-7 lineage, supervisory review under FINRA, change management under SOC 2 — with the same control-to-evidence traceability as every other rule. More detail on agent and MCP governance.
Meilynx doesn't replace identity, cloud security, data protection, or security operations platforms. It extends their disciplines into the AI workflow and gives governance, security, and engineering a shared operational record.
Policy without enforcement is intent. Enforcement without evidence is difficult to prove. Operational AI governance requires both.
Closing the gap
The lesson isn't that organizations need more AI policies. They need to understand how AI participates in business operations, restrict what each workflow can access and do, enforce those rules during execution, and preserve evidence of every consequential decision.
The place to start is one important AI-enabled workflow. Map every identity, application, data source, model, and tool involved. Define the permitted actions at each boundary. Then determine whether those controls actually operate in production, and whether the organization could prove it afterward.
AI adoption is moving quickly. Governance has to operate inside the workflow, at the same speed as the AI it's expected to govern — from prompt to examiner, on one audit chain.