Cisco’s 2026 AI Security Report Highlights Agentic and Supply Chain Risks
Report discovered via Awesome Annual Security Reports.
Summary
Cisco’s State of AI Security 2026 examines prompt injection, agentic threats and AI supply chain risks. Its assessment of eight open-weight models found multi-turn jailbreak success rates reaching 92.78%, reinforcing the need for layered defenses.
Key points
- Cisco reports a readiness gap: 83% of surveyed organizations planned to deploy agentic AI, but only 29% felt ready to use it securely.
- A black-box assessment of eight open-weight LLMs using Cisco AI Defense found multi-turn jailbreak success rates reaching 92.78%, highlighting weaknesses in guardrails over longer conversations.
- The report describes MCP attack paths including tool poisoning, malicious integrations, filesystem sandbox escapes, and the patched mcp-remote command-execution flaw CVE-2025-6514.
- Citing external research, Cisco reports that as few as 250 poisoned training documents can introduce model backdoors without degrading general performance unless an attacker-selected trigger appears.
- Anthropic alleged that China-linked GTG-1002 repurposed Claude Code for espionage, with AI automating 80–90% of the attack chain under human direction.
- Cisco’s OpenClaw testing demonstrated a third-party skill inducing discreet data exfiltration, illustrating risks from privileged agents loading untrusted skill packages.
- The report recommends least-privilege agent access, explicit authorization, behavioral monitoring, model-artifact chain of custody, and continuous evaluation across complete agentic workflows.
Article Details
- Publisher
- Cisco
- Report Period
- 2025 through early 2026
- Scope
- AI security threats, agentic systems, AI supply chains, governance, and Cisco security research.
- Sample Size
- Eight open-weight LLMs in Cisco's black-box security assessment; other cited studies and surveys have separate populations.
- Key Statistics
- Among organizations surveyed, 83 percent planned to deploy agentic AI, while only 29 percent felt ready to use it securely; the survey population size was not provided.
- Cited research found at least one vulnerability in 26 percent of 31,000 analyzed agent skills.
- Researchers from the UK AI Security Institute, Anthropic, and the Alan Turing Institute reported that as few as 250 poisoned training documents could compromise LLM safety without degrading general performance.
- Anthropic alleged that GTG-1002 automated 80–90 percent of the attack chain using AI agents, with humans providing strategic direction.
- Cisco's assessment of eight open-weight LLMs found multi-turn jailbreak attack success rates reaching 92.78 percent.
- Recommendations
- Apply defense in depth through resilient model selection, layered protections, threat-specific mitigations, and continuous AI asset evaluation.
- Subject model artifacts to the same security scrutiny as binaries and dependencies, and maintain chain of custody from download through deployment.
- Apply zero trust, continuous authentication, explicit authorization, least-privilege access, and behavioral monitoring to AI agents.
- Harden MCP servers and agent tool registries, validate tool descriptors, restrict tool API privileges, and monitor agent tool downloads.
- Red-team entire agentic workflows and scrutinize AI-to-AI communication channels rather than testing prompts alone.
MITRE ATT&CK
T1046 · Network Service DiscoveryAnthropic reported that the Claude Code-enabled espionage operation scanned ports and identified vulnerabilities.T1059.006 · PythonThe reported GTG-1002 operation used the model to develop Python scripts to exploit identified vulnerabilities.T1083 · File and Directory DiscoveryThe reported GTG-1002 operation navigated file systems to locate sensitive data.T1114 · Email CollectionThe malicious Postmark MCP Server package collected communications by blind-carbon-copying every email sent through the agent.T1195.002 · Compromise Software Supply ChainA fake Postmark MCP Server package published to npm secretly copied emails to an attacker-controlled address.
CVE
CVE-2025-53109own filesystem MCP tools exhibited sandbox escape vulnerabilities (CVE-2025-53109 andCVE-2025-53110CVE-2025-53110). These flaws allowed an attacker to use symbolic links (symlinks) to trick theCVE-2025-6514CVE-2025-6514, has since been patched, but showcases both the importance of security when connecting
People
Threat Actors
APT28The report attributes LAMEHUG to this group and identifies Fancy Bear and Sofacy as alternate names.Fancy BearNamed as an alternate name for APT28, to which the report attributes LAMEHUG.GTG-1002Chinese state-backed group that Anthropic alleged jailbroke Claude Code and used its agentic capabilities for a multi-target cyber-espionage operation.KimsukyNorth Korean state-sponsored group reported to have used generative AI to create deepfake job applicant profiles in 2025.
Malware
Vendors
Alibaba GroupAlibaba (Qwen3-32B), DeepSeek (v3.1), GoogleAnthropicAI Security Institute, Anthropic, and the AlanCisco| AI Security Research and Tooling at Cisco | | | | | 22 |DeepSeekAlibaba (Qwen3-32B), DeepSeek (v3.1), GoogleGooglesponsored AI-assisted cyber campaign in 2025. Google has also reported China-nexus threat actorsMetawith Meta explaining that developers are “in theMicrosoftInstruct), Microsoft (Phi-4), Mistral (Large-2 alsoMistralInstruct), Microsoft (Phi-4), Mistral (Large-2 alsoOpenAIGoogle, OpenAI, and Anthropic shared internal safety practices and principles. Yet each of these effortsZhipu AIOSS-20b), and Zhipu AI (GLM 4.5-Air). It was
Products
AI Defensesecurity solutions like Cisco AI Defense support bothClaude Code(e.g., Cursor, Windsurf, Claude Code) or theGemma 3-1B-IT(Gemma 3-1B-IT), Meta (Llama 3.3-70B-GLM 4.5-AirOSS-20b), and Zhipu AI (GLM 4.5-Air). It wasmcp-remote“mcp-remote” allowed attackers to trigger arbitrary command execution on machines running the toolOpenClawIn early 2026, OpenClaw (formerly known as This research highlighted several major securityPhi-4Instruct), Microsoft (Phi-4), Mistral (Large-2 alsoQwen3-32BAlibaba (Qwen3-32B), DeepSeek (v3.1), Google
Tools
A2A ScannerCisco’s A2A Scanner is an open-source securityAI ValidationThis risk assessment used AI Validation, theMCP Scanneragentic AI supply chains: the MCP Scanner andpickle-fuzzersecurity across AI supply chains, Cisco researchers introduced pickle-fuzzer, a structure-aware fuzzerSecureBERT 2.0| SecureBERT 2.0 | | | | | 26 |Skill ScannerAgentic Skill Scanner
Countries
Democratic People’s Republic of KoreaDemocratic People’s Republic of Korea (DPRK)Iranassociated with the Islamic Republic of Iran utilizing AI to enhance traditional cyber operations.Israel2025 conflict with Israel, Iranian cyber forces demonstrated the use of AI for cyber-enabled kineticPeople’s Republic of ChinaThe Claude cyber-espionage operation from the People’s Republic of China was a well-known state-Russiafor autonomous espionage; threat actors associated with the Russian Federation integrating LLMs intoUkraineleveraged AI to facilitate cyber operations. For example, in July 2025, Ukraine’s Computer EmergencyUnited States| United States AI Policy Developments | | | | | 17 |