Cato’s 2026 Threat Report Highlights Shadow AI and Prompt-Injection Risks

Oct 19, 2026 · Original Report (PDF) ↗

Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.

Summary

Cato CTRL’s annual report examines enterprise AI security using 2025 telemetry from more than 4,000 customers, highlighting prompt injection, malicious AI workflows, data exposure, and the need for stronger governance.

Key points

The report draws on Cato CTRL’s analysis of 6.7 trillion network flows across more than 4,000 customers globally during 2025.
Within its observed customer networks, Cato reports average AI adoption across industries reached 92% in Q4 2025, shifting the security challenge toward governing existing usage.
Cato’s HashJack research describes malicious instructions hidden in URL fragments that AI browser assistants ingest, potentially enabling phishing, credential theft, and agentic data exfiltration without compromising the referenced website.
An Atlassian MCP and Jira Service Management proof of concept showed how an external support ticket could inject instructions into an AI action running with an internal user’s privileges, enabling data disclosure or modification.
In a controlled test, Cato modified a Claude Skill to execute MedusaLocker ransomware under an existing approval context, demonstrating risks from shared automation modules and incomplete execution visibility.
The report also describes Grok- and Mixtral-powered WormGPT variants and demonstrations of fake passport creation using ChatGPT’s image generator, highlighting AI-assisted fraud risks.
Recommendations include inventorying AI usage, isolating untrusted inputs, monitoring AI actions, limiting agent privileges, and requiring approval or policy checks for high-risk operations.

Article Details

Publisher: Cato Networks
Report Period: 2025-01-01 to 2025-12-31
Scope: Global enterprise AI application adoption, shadow AI risks, and five AI security discoveries documented by Cato CTRL in 2025.
Sample Size: 6.7 trillion network flows across more than 4,000 customers globally.
Key Statistics: In Q4 2025, 20 of 25 industry verticals had AI adoption rates of at least 90% within the report's monitored population.
Average AI adoption across industries remained above 90% throughout 2025 and reached 92% in Q4.
From Q1 to Q4 2025, adoption increased by 33% for Copilot, 39% for OpenAI, 72% for Gemini, 24% for Grammarly, and 63% for Perplexity.
Manufacturing was the largest usage industry for 15 of the 20 most-used AI applications in 2025.
Recommendations: Validate, sanitize, inspect, and isolate untrusted AI inputs, including metadata, URLs, and file fragments.
Monitor AI prompts, responses, and downstream actions; correlate them with user activity, network traffic, and application logs to detect anomalies.
Inventory enterprise AI services, enforce risk-aligned usage policies, and regularly review AI integrations.
Restrict AI agents to least-privilege access, separate read, write, and execution permissions, and require approval or policy checks for high-risk actions.
Strengthen identity and document verification, train users about AI-assisted deception, and require out-of-band verification for sensitive requests.