All resources
Referencestatistics10 min readCC BY 4.0
AI agent security statistics (2026)
The measured numbers for prompt injection, wrong tool calls, MCP risk and agent adoption, each linked to its primary source with the date the source carries. Compiled and checkable.
agent-securityprompt-injectionmcpstatisticsresearch
Every figure on this page comes from a primary source that Alyria (alyria.ai) checked on November 3, 2026: the paper, the vendor system card, the leaderboard data file, or the OWASP and NCSC page. Each row carries the date its source carries. Where a vendor reports its own numbers, the row says so, because vendor figures are not directly comparable (see the caveats at the end).
Last updated: November 3, 2026.
How to cite this page: Alyria, "AI agent security statistics (2026)", https://www.alyria.ai/resources/ai-agent-security-statistics, last updated November 3, 2026. Every row links to the primary source, and citing the primary source directly is always better.
Prompt injection
| Statistic | Context | Source | Date |
|---|---|---|---|
| 2.0% attack success within 15 attempts | Claude Opus 5 on the Gray Swan indirect-prompt-injection benchmark, tested without product safeguards | Anthropic Transparency Hub | October 2026 |
| 43.9% within 15 attempts | GPT-5.6 Luna on the same benchmark; GPT-5.6 Sol was about 10 times as likely to be attacked successfully as Opus 5, and one attempt against Sol succeeded 3.1% of the time | Anthropic Transparency Hub | October 2026 |
| 1,130 transferable attacks | Attack set behind the benchmark, covering coding, computer use and tool use; built with the UK AI Safety Institute and the US Center for AI Standards and Innovation | Anthropic Transparency Hub | October 2026 |
| 1,810 curated attacks | OpenAI's attack set for the same Gray Swan benchmark, drawn from the Q1 to Q2 2026 arenas across coding, computer use and tool use | GPT-6 Astra System Card | September 3, 2026 |
| 17.8% with one attempt, 78.6% with 200 adaptive attempts, 57.1% with safeguards | Claude Opus 4.6 in GUI computer use, counting a goal as breached if any attempt succeeds | Claude Opus 4.6 System Card | February 2026 |
| 8.0% model only against 1.4% with safeguards | Claude Opus 4.5 in browser use, 100 attempts per environment; Sonnet 4.5 went from 13.8% to 1.9% | Anthropic, prompt injection defenses | November 24, 2025 |
| 0.4% of attacks succeeded | Live bug bounty over more than 15,000 attempts against Claude Opus 4.8 and 4.7; Sonnet 4.6 0.9%, GPT-5.5 1.6% | Anthropic Transparency Hub | October 2026 |
| 47.69% targeted attack success, utility 69.07% to 50.08% | GPT-4o with no defense on AgentDojo, 97 user tasks and 629 security cases | AgentDojo results | Run dated June 5, 2024 |
| 6.84% targeted attack success, utility 72.16% | The same model with a tool-filter defense: the agent picks its tools before it sees untrusted data | AgentDojo results | Run dated June 5, 2024 |
| 92% of Slack-suite injections succeed, up to 70% at the end of a tool response | GPT-4o where attackers control a large share of tool output | AgentDojo paper, arXiv 2406.13352 | June 19, 2024 |
| 42.9% for Claude 3.7 Sonnet in computer use, 7.6% for Operator, 60% end to end for Claude Sonnet 4.5 | RedTeamCUA, hybrid web and OS sandbox over 864 examples; independent results run higher than vendor results | RedTeamCUA, arXiv 2505.21936 | May 28, 2025 |
| 99.8% TAP attack success on Gemini 2.0, 53.6% on Gemini 2.5 | Google DeepMind's own adaptive-attack evaluation, about 47% average reduction from adversarial training | arXiv 2505.14534 | May 20, 2025 |
| 208,095 unique human-written attack prompts from 839 participants | LLMail-Inject challenge; attack success 32% for Meta SecAlign, 58% for GPT-4o, 47% for GPT-5 mini | LLMail-Inject, arXiv 2506.09956 | June 11, 2025; these model results are from v2, October 9, 2026 |
| 1.8 million attacks and 60,000+ successful policy violations | 22 frontier agents, 44 scenarios, the largest public agent red-teaming competition; nearly all agents exhibited policy violations within 10 to 100 queries | arXiv 2507.20526 | July 28, 2025 |
| 23% susceptibility with mitigations, 62% with none, 47% with prompting only | Operator, 31 automatically checkable injection scenarios | Operator System Card | January 23, 2025 |
| 67% resistance to active data exfiltration in the visual browser (75% for Operator o3), 78% in context | ChatGPT agent, model-only safety training rather than the full mitigation stack | ChatGPT Agent System Card | July 17, 2025 |
Tool calls, reliability and MCP
| Statistic | Context | Source | Date |
|---|---|---|---|
| 77.47% overall accuracy, 68.38% multi-turn | Claude Opus 4.5, the top entry of 109 on the Berkeley Function Calling Leaderboard, so the leader still misses about one in three multi-turn tasks | BFCL | Data last updated April 12, 2026 |
| 79.61% to 51.75%, pass on one try to pass on four of four | Claude Opus 4.5 on retail; GPT-5.2 moves from 81.58% to 51.75% on the same measure | tau-bench leaderboard | Submissions February to March 2026 |
| 70%, 72%, 48% pass on four of four | Airline suite: Claude Opus 4.5, GPT-5.2, Claude Sonnet 4.5 | tau-bench leaderboard | Submissions February to March 2026 |
| Under 50% of tasks succeed, pass on eight under 25% | Function-calling agents on retail, from the paper that introduced the measure | tau-bench, arXiv 2406.12045 | June 17, 2024 |
| 23.9% failure rate even for the safest agent; 68.8% of flagged failures judged valid | ToolEmu, 36 high-stakes tools and 144 test cases | ToolEmu, arXiv 2309.15817 | September 25, 2023 |
| 72.8% tool-poisoning attack success, no model refused more than 3% | 20 LLM agents against 45 live MCP servers, 353 tools and 1,348 malicious cases; o1-mini was the high figure, Claude 3.7 Sonnet the highest refusal rate | MCPTox, arXiv 2508.14925 | August 19, 2025 |
| 7.2% of 1,899 servers with general vulnerabilities, 5.5% with MCP-specific tool poisoning | First large-scale empirical study of open-source MCP servers | MCP at First Glance, arXiv 2506.13538 | June 16, 2025 |
| 43% command injection, 30% SSRF, 22% path traversal | Pen test of popular MCP servers; a small indicative sample rather than a survey | Equixly | March 29, 2025 |
| 88% of MCP servers require credentials, 53% use long-lived static secrets, 8.5% use OAuth, 79% pass keys through environment variables | Survey of 5,200+ open-source MCP servers | State of MCP Server Security 2025 | October 15, 2025 |
| 75% of 66 real-world agent tools vulnerable to cross-tool hijacking | LangChain and LlamaIndex tools under the Chord dynamic scanner | Les Dissonances, arXiv 2504.03111 | April 4, 2025 |
| 9.3 CVSS for a zero-click prompt-injection exfiltration | EchoLeak, AI command injection in Microsoft 365 Copilot | CVE-2025-32711, NVD | June 11, 2025 |
| 9.6 CVSS for OS command injection | mcp-remote, when connecting to untrusted MCP servers: client-side supply-chain remote code execution | CVE-2025-6514, NVD | July 9, 2025 |
Adoption and industry
| Statistic | Context | Source | Date |
|---|---|---|---|
| 73% use coding assistants and agents daily, and they are the top AI use case at 66% | Survey of 30,000+ respondents; Claude Code 66% and GitHub Copilot 59% lead | Stack Overflow Developer Survey 2026 | October 6, 2026 |
| 31% of daily users spend four or more hours a day with them | Same survey | Stack Overflow Developer Survey 2026 | October 6, 2026 |
| 48% trust AI output only when they can easily verify it, 20% use AI to deploy or operate production systems | Trust is conditional, and the production share is the one to plan controls around | Stack Overflow Developer Survey 2026 | October 6, 2026 |
| 14.1% used AI agents at work daily a year earlier, and 37.9% had no plans to adopt | The 2025 baseline that shows how fast agent adoption moved | Stack Overflow Developer Survey 2025 | 2025 edition |
| Over 40% of agentic AI projects will be canceled by the end of 2027 | Analyst forecast, not measured data; the stated reasons are cost, unclear value and inadequate risk controls | Gartner | June 25, 2025 |
Frameworks and risk taxonomies
| Statistic | Context | Source | Date |
|---|---|---|---|
| LLM01:2025 Prompt Injection ranked first | OWASP's own caveat: "It is unclear if there are fool-proof methods of prevention for prompt injection" | OWASP LLM01:2025 | 2025 edition |
| LLM06:2025 Excessive Agency | Root causes named as excessive functionality, excessive permissions and excessive autonomy | OWASP LLM06:2025 | 2025 edition |
| ASI01 Agent Goal Hijack and ASI02 Tool Misuse and Exploitation open the list | OWASP Top 10 for Agentic Applications 2026, peer reviewed with 100+ contributors, ten entries from ASI01 to ASI10 | OWASP GenAI | December 9, 2025 |
| MCP01 to MCP10, still in beta | OWASP MCP Top 10: token mismanagement, scope creep, tool poisoning, supply chain, command injection, contextual payload injection, insufficient authorization, missing audit and telemetry, shadow servers, context over-sharing | OWASP MCP Top 10 | 2025 beta |
Caveats for anyone quoting these
- Vendor numbers are not directly comparable. Anthropic, OpenAI and Google each use different attackers, environments and attempt budgets. The Gray Swan indirect-prompt-injection benchmark is the closest thing to a shared yardstick, and the two vendors that report it use different attack sets: 1,130 for Anthropic (Anthropic Transparency Hub, October 2026) and 1,810 for OpenAI (GPT-6 Astra System Card, September 3, 2026).
- Independent results run higher than vendor results. RedTeamCUA's authors publicly dispute Anthropic's low computer-use attack rates, and their 60% end-to-end figure for Claude Sonnet 4.5 is in the paper.
- The OWASP MCP Top 10 is in beta. Cite it as a beta taxonomy, not a settled standard.
- AgentDojo is not a leaderboard. Its maintainers say so; cite individual runs with their dates, which is what the rows above do.
- Equixly's MCP figures come from a small pen-test sample. Treat them as indicative, not as a survey.
- Vendor self-reports are self-reports. Where a row says a vendor tested a model without product safeguards, the number describes the model, not the product a customer would run.
Where Alyria fits
These statistics describe what a model cannot do: separate instructions from data, and call the right tool every time. Alyria, at alyria.ai, is the agent governance platform built around that limit. Policy is written once in Lyra and enforced locally by Alyria Beacon at every tool and MCP call, in three layers: deterministic rules in sub-millisecond time, sequence rules over the run's history, and semantic checks by the Decider at boundaries such as a push or a pull request. Every decision lands in one signed, tamper-evident audit chain.
Read the research summary for what these numbers mean in practice, the reference architecture for where each control sits, and the semantic policy examples for what the rules look like. To see the numbers against your own fleet, start free.