Trend Micro Predicts AI-Driven Attacks and Agent Security Risks Will Grow in 2026
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Trend Micro’s 2026 outlook predicts more AI-automated attacks, compromised agent workflows, session theft, and data-focused extortion. It recommends stronger identity controls, cloud visibility, secure code review, and tested recovery plans.
Key points
- Trend Micro predicts compromised AI agents, prompt injection, and poisoned workflow components will create security risks across connected enterprise systems.
- Its telemetry shows web apps hosted on Vercel and Lovable increased by 57% and 660%, respectively, from January to September 2025; the report warns that AI-generated code needs security review.
- The report anticipates greater APT collaboration through shared access, infrastructure, and payloads, alongside increased targeting of development pipelines and software suppliers.
- Enterprise attackers are expected to increasingly target authenticated sessions and tokens, while AI agents’ broad API keys and static secrets create additional identity risks.
- Cloud forecasts emphasize overprivileged credentials, exposed APIs, poisoned containers, and multi-cloud visibility gaps, with GPU resources attracting compute theft and access resale.
- Trend Micro predicts ransomware operators will increasingly analyze stolen data for targeted extortion and automate attack stages and negotiations; these are forecasts, not confirmed universal capabilities.
- Recommended priorities include continuous identity verification, AI workflow audit trails, exposure-based remediation, offline or immutable backups, and tested recovery playbooks.
Article Details
- Publisher
- Trend Micro
- Report Period
- 2026 outlook, incorporating observations from 2025
- Scope
- Enterprise cybersecurity risks across AI, APTs, enterprise systems, cloud, ransomware, and vulnerabilities.
- Key Statistics
- Trend Micro telemetry showed increases in hosted vibe-coded web apps of 57% on Vercel and 660% on Lovable from January to September 2025.
- Cited research found that approximately 45% of AI-generated code introduced security bugs; the supplied report does not disclose the study sample size.
- Trend Micro reports that approximately 47% of organizations struggle to maintain full visibility of their cloud assets; the population size and measurement period are not disclosed.
- The report cites research indicating that around three quarters of organizations have experienced a serious cloud security incident stemming from misconfiguration; the population size and measurement period are not disclosed.
- Recommendations
- Evaluate AI-generated code for security risks and reject non-preapproved AI models unless they run in isolated sandbox environments.
- Apply continuous verification, behavior monitoring, verified audit trails, and adversarial testing to AI agents and workflows.
- Use phishing-resistant MFA and out-of-band verification for sensitive transactions, supported by strict access controls and continuous device verification.
- Prioritize remediation using asset criticality, exposure, and exploitation likelihood alongside vulnerability severity, including misconfigurations and access-control gaps.
- Maintain offline and immutable backups, tested recovery playbooks, fallback workflows, and practiced incident response plans.
MITRE ATT&CK
T1195.001 · Compromise Software Dependencies and Development ToolsThe report describes a malicious MCP server incident and observed malicious models uploaded to Hugging Face as examples of compromised software and AI supply chains.T1195.002 · Compromise Software Supply ChainThe report forecasts ransomware delivery through tampered packages, development pipelines, container images, and malicious software updates.T1557 · Adversary-in-the-MiddleAdversary-in-the-middle phishing is identified as an increasingly observed method for compromising cloud users.T1562.001 · Disable or Modify ToolsThe report forecasts that attackers will disable endpoint detection and response systems to maintain access.T1566 · PhishingThe report describes increased phishing activity over the preceding year, including email, device-code, MFA, and voice phishing targeting cloud access.
Threat Actors
Malware
FunkSecWhat began as AI-assisted malware development in 2025, as seen in attacks involving FunkSec, [^64] will mature into operationally independent malware such as LameHug, [^65] marking a major leap in automation.LAMEHUGWhat began as AI-assisted malware development in 2025, as seen in attacks involving FunkSec, [^64] will mature into operationally independent malware such as LameHug, [^65] marking a major leap in automation.
Products
ClaudeOne prime example of this was the S1ngularity case, where AI command-line tools (specifically Claude, Gemini, and Q) were used to aid in reconnaissance efforts on compromised systems.Cursorprompt injection flaws and bugs in AI-enabled environments (as seen in the CurXecute vulnerability in Cursor IDE), [^70] offering fresh entry points for exploitation.DifyAs the enterprise adoption of agentic AI accelerates, particularly through workflow platforms such as Dify and n8n, new vulnerabilities will emerge.GeminiOne prime example of this was the S1ngularity case, where AI command-line tools (specifically Claude, Gemini, and Q) were used to aid in reconnaissance efforts on compromised systems.LovableBased on our telemetry data, vibe coding tools such as Lovable and Vercel have seen significant increases this year in the number of vibe-coded web apps hosted on their platforms, with Vercel seeing a 57% increase andMicrosoft Entra IDbeen an increase in sophisticated phishing attacks, such as AiTM [^40] and MFA phishing, malicious Azure Entra ID applications, [^41] device code phishing, [^42] and voice phishing, [^43] with threat actors evenn8nAs the enterprise adoption of agentic AI accelerates, particularly through workflow platforms such as Dify and n8n, new vulnerabilities will emerge.QOne prime example of this was the S1ngularity case, where AI command-line tools (specifically Claude, Gemini, and Q) were used to aid in reconnaissance efforts on compromised systems.VercelBased on our telemetry data, vibe coding tools such as Lovable and Vercel have seen significant increases this year in the number of vibe-coded web apps hosted on their platforms, with Vercel seeing a 57% increase and
Tools
FraudGPTMeanwhile, malicious AI chatbots on the dark web (e.g., WormGPT and FraudGPT) [^24] will democratize the creation of convincing phishing and other harmful content as crime-as-a-service.MelioratorAccording to US law enforcement, [^26] Russia-aligned APT actors began using Meliorator as early as 2022.WormGPTMeanwhile, malicious AI chatbots on the dark web (e.g., WormGPT and FraudGPT) [^24] will democratize the creation of convincing phishing and other harmful content as crime-as-a-service.
Countries
ChinaTo evade their monitoring efforts, these threat actors, particularly those aligned with countries like China, Iran, North Korea, and Russia, are expected to shift away from US-based AI products to developing homegrownIranevade their monitoring efforts, these threat actors, particularly those aligned with countries like China, Iran, North Korea, and Russia, are expected to shift away from US-based AI products to developing homegrown AIIsraelMeliorator is an AI-enabled bot farm generation and management software used to disseminate disinformation to and about some countries, including countries in the EU, Israel, Ukraine, and the US.North Koreamonitoring efforts, these threat actors, particularly those aligned with countries like China, Iran, North Korea, and Russia, are expected to shift away from US-based AI products to developing homegrown AI tools.RussiaAccording to US law enforcement, [^26] Russia-aligned APT actors began using Meliorator as early as 2022.UkraineMeliorator is an AI-enabled bot farm generation and management software used to disseminate disinformation to and about some countries, including countries in the EU, Israel, Ukraine, and the US.United StatesAccording to US law enforcement, [^26] Russia-aligned APT actors began using Meliorator as early as 2022.
Industries
AerospaceAPT groups will focus on the drone, maritime, aerospace, and telecommunications sectors — all critical to modern defense and secure communications — to steal proprietary technologies, disrupt supply chains, and gatherDefenseEnterprises will need to shift from reactive defense to anticipatory resilience, embedding security into every stage of AI adoption and automation.droneAPT groups will focus on the drone, maritime, aerospace, and telecommunications sectors — all critical to modern defense and secure communications — to steal proprietary technologies, disrupt supply chains, and gatherEnergyCritical infrastructure industries, such as defense, energy, finance, and telecommunications, will be priority targets for both espionage and destructive campaigns, as cyber operations become increasingly linked withfinanceinitiates a large emergency order, that error could propagate through procurement, logistics, and finance before any human notices the issue.MaritimeAPT groups will focus on the drone, maritime, aerospace, and telecommunications sectors — all critical to modern defense and secure communications — to steal proprietary technologies, disrupt supply chains, and gatherTelecommunicationsPrepositioning efforts, such as the silent compromise of critical infrastructure and telecommunications, will persist.