Security Report · raw.githubusercontent.com

OrcaRouter’s 2026 AI Threat Report Examines Prompt Injection and Agent Security Gaps

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

OrcaRouter’s 2026 AI Threat Report synthesizes public research on prompt injection, agent data theft, poisoned tools and runaway spending, recommending scoped identities, action controls and run-level monitoring.

Key points

The June 2026 report uses named public sources rather than OrcaRouter customer data; illustrative exhibits represent analytical judgment, and some attack narratives are composites.
Citing IBM, it reports that 13% of organizations experienced breaches of AI models or applications; 97% of that breached subset lacked proper AI access controls.
The taxonomy groups threats into content, action, economic, and trust or supply-chain families, emphasizing that attacks can combine malicious text with legitimate agent capabilities.
The EchoLeak case study describes crafted email instructions causing Microsoft 365 Copilot to collect sensitive context and exfiltrate it through an automatically fetched image URL without user interaction.
A GitHub MCP demonstration used instructions in a public issue to redirect an authorized agent into publishing private repository data in a public pull request.
The report identifies denial-of-wallet risks from retry loops, injected workload expansion and stolen keys, recommending per-run cost ceilings and behavioral monitoring beyond individual request checks.
Recommended controls include scoped, expiring agent identities, default-deny tool and network policies, MCP manifest pinning, input/output screening, approval gates and run-correlated audit logs.

Article Details

Publisher: OrcaRouter Security Research, Continuum AI Corp
Report Period: 2026 edition, published June 2026; public sources verified during May–June 2026
Scope: Enterprise AI threats and runtime defenses, drawing on public incident disclosures, third-party surveys, telemetry, and government data. Illustrative exhibits and composite scenarios are not measured incident data.
Sample Size: No unified sample; source-specific populations and methodologies. No OrcaRouter customer data was used.
Key Statistics: IBM's 2025 reporting found that 13% of organizations reported breaches of AI models or applications; 97% of that breached population reported lacking proper AI access controls.
Gartner's survey of 302 cybersecurity leaders, conducted March–May 2025, found that 32% reported prompt-based attacks on AI applications and 29% reported attacks on GenAI application infrastructure.
Pillar Security's October 2024 telemetry from more than 2,000 production LLM applications reported an average successful attack duration of 42 seconds, with 90% of successful attacks leaking sensitive data.
The FBI's 2025 Internet Crime Report recorded 22,364 AI-related complaints and nearly $893 million in losses.
IBM's 2025 breach data indicated that one in five breached organizations traced a breach to shadow AI.
Recommendations: Inventory sanctioned and shadow AI deployments; give each agent a separate, scoped, expiring credential with restricted tools, data access, and spend.
Screen input and output for prompt injection, sensitive personal data, secrets, and unsafe output; roll out controls through observe, shadow, and enforce stages.
Apply default-deny tool and network egress policies, require approval for irreversible actions, and enforce per-key and per-run spending ceilings.
Pin reviewed MCP manifests, inspect changes, quarantine new capabilities, and enforce policy on every dispatch.
Maintain tamper-evident, run-correlated audit logs and behavioral monitoring; red-team deployed controls and conduct agent-incident tabletop exercises.