Wiz Report Finds Widespread AI Adoption Expanding Cloud Security Risks
Summary
Wiz’s 2026 report, based on hundreds of thousands of cloud environments, finds widespread use of AI services, coding assistants, agents, and MCP servers, alongside systemic security risks and faster vulnerability discovery and exploitation.
Key points
- At least 81% of observed cloud environments use managed AI services, while 90% run self-hosted AI software; 68% of organizations running self-hosted models ingest them through third-party software.
- At least 80% of organizations have developers using AI IDE extensions, and 71% have at least one AI coding assistant.
- Wiz Research found that roughly one in five organizations using AI-powered vibe-coding platforms had applications affected by systemic security issues linked to shared generation patterns.
- Self-hosted AI agents were present in at least 57% of organizations, and MCP servers appeared in 80% of environments, expanding risks around permissions, internet access, and sensitive data.
- The report describes malware using LLMs to generate commands and adapt execution at runtime, as well as attackers abusing AI-enabled OAuth integrations to move laterally across SaaS environments.
- AI-assisted analysis contributed to discovering 13 zero-day vulnerabilities in widely deployed cloud software, according to the article.
- The report recommends inventorying AI assets, extending governance across teams, and using identity, permission, and data context to prioritize risk.
Article Details
- Publisher
- Wiz IO
- Report Period
- 2026
- Scope
- AI adoption and security risks across cloud environments, including AI development, agents, MCP servers, and exploitation.
- Sample Size
- Hundreds of thousands of real-world cloud environments; the report does not provide an exact count.
- Key Statistics
- At least 81% of observed cloud environments use managed AI services.
- 90% of observed cloud environments run self-hosted AI software; 68% of organizations running self-hosted models ingest them through third-party software.
- At least 80% of organizations have developers using AI IDE extensions, and 71% have at least one AI coding assistant present.
- Roughly one in five organizations using AI-powered “vibe coding” platforms had applications affected by systemic security issues, according to Wiz Research findings from late 2025.
- At least 57% of organizations have deployed self-hosted AI agent technologies, and MCP servers appear in 80% of environments.
- Recommendations
- Treat AI components as first-class citizens in asset inventories.
- Integrate AI security governance with application security and data governance.
- Use context about AI assets’ connections to identities, permissions, and sensitive data to prioritize risks.