88% of Enterprises Had an AI Agent Security Breach — Here's What No-Code Teams Must Learn

If you're an ops director who's spent the last year enthusiastically wiring AI agents into your workflows, I have some bad news and some worse news.

The bad news: nearly nine in ten organisations that deployed AI agents had a security breach connected to them in the past year. The worse news: one in five organisations cannot tell you whether their employees are even using AI agents at all.

That data comes from AvePoint's 2026 State of AI report, published at the end of June. The survey of 750 IT leaders across financial services, healthcare, and government found that 88.4% of organisations experienced at least one AI agent-related security incident in the past 12 months. A nearly identical share (89.5%) said the same about generative AI broadly.

These numbers land differently depending on where you sit. If you're in enterprise IT with a dedicated security team, a SOC, and a compliance budget, this is a governance problem you can throw resources at. If you're an ops director at a 200-person company who built a customer portal last month using AI tools and forgot to check the access controls, this is a career problem.

> TL;DR: AvePoint's 2026 report found 88.4% of enterprises had an AI agent breach. Data leakage and prompt injection were the top causes. The visibility gap tripled: 21% of orgs can't tell if employees are using unsanctioned agent tools. Ops teams using no-code and AI tools face the same structural risks with far fewer security resources. The fix isn't more security talent; it's platform choices that bake governance in.

What's actually going wrong?

The most common incidents are not sophisticated attacks. They're data leakage (50.1% of affected organisations) and manipulation via untrusted inputs (49.6%).

Data leakage means your agent could reach more data than it should, and that access walked out the door. You connected it to your CRM, your files, your customer database so it could be useful, and now everything it can read is everything it can expose. Same access control mistake IT teams have been making for twenty years, now turbocharged by something that can act on its own.

The manipulation vector is stranger and more dangerous. Prompt injection means someone hid instructions inside a document, an email, or a webpage, the agent read them, and the agent obeyed. It didn't malfunction. It worked exactly as designed. The problem is it cannot distinguish between your instructions and an attacker's. That's not a bug. That's the architecture.

Why should no-code teams care?

The natural reaction is to file this under "enterprise problems" and move on. You don't have 750 IT leaders or a security operations centre. You have a small ops team, a growing stack of AI-built tools, and a boss who's asking why internal tooling suddenly costs less and ships faster.

But the mechanics are identical. When an ops director prompts an AI coding tool to "build me a dashboard that shows all customer orders with their payment status," the resulting app connects to a database and serves data. If nobody checked whether the app's API requires authentication, or which rows each user can see, or whether API keys are sitting in client-side code, you have the same data leakage vector that hit half of enterprise respondents.

The difference: the enterprise has an incident response plan and cyber insurance. Your team has neither.

The AvePoint report also surfaced something I find more alarming than the breach rate itself. The share of organisations unable to determine whether employees are using unsanctioned generative AI tools went from 6.3% in 2025 to 17.6%. It nearly tripled. For AI agents specifically, the blind spot is even larger at 21.1%.

In plain language: the tools are spreading faster than anyone's ability to track them. If you think this is contained to large organisations, ask yourself how many people on your team signed up for ChatGPT, Claude, or a free AI coding tool in the last six months without telling anyone.

Is the number actually that high?

One fair objection: AvePoint sells AI governance and security tooling. A survey that finds nearly every company has been breached is, conveniently, a survey that sells AvePoint's product. "At least one incident" is also a forgiving bar. It absorbs everything from a real breach to a minor misconfiguration someone noticed during testing.

But I went looking for independent sources, and they describe the same shape of risk. OWASP now ranks prompt injection as the number one risk for LLM and agent applications, and their 2026 agent security work catalogues real CVEs and breach reports. Help Net Security reported in June that prompt injection remains the primary driver of agentic AI security failures in production. OWASP is a volunteer security project with nothing to sell you.

Discount the 88% figure by half if you want. You're still at most companies.

So what do we actually do about it?

When I talk to ops teams building internal tools, the conversation about security usually goes: "We'll add permissions later" or "It's only internal users" or "Nobody would bother attacking us."

Every one of those statements was reasonable five years ago. None of them holds up when your tool is connected to live data and built by prompting an AI that doesn't warn you about access control gaps.

This is where the divide between free-form AI coding tools and structured no-code platforms stops being academic. Build with something like Bolt or Lovable, and security is entirely your problem. The tool will happily generate an app with an unauthenticated API endpoint pointed at your production database. It doesn't know your threat model and it doesn't care.

Build on a platform where governance is baked into the architecture, and the platform enforces authentication, permission models, and audit trails because those things are part of how it works. You can't accidentally expose every row in your customer table because the platform won't let you. The access model exists before you write a single prompt. Platforms like Stacker (disclosure: we make it), Bubble, and Webflow all operate this way.

This isn't a small distinction. It's the difference between the AvePoint numbers and something manageable. Enterprises are learning this the expensive way. Ops teams can learn it now, before their first incident.

The takeaway

The 88% number is probably inflated by who commissioned it. But the underlying pattern is independently confirmed and getting worse: AI agents routinely expose data because access controls are an afterthought, and most organisations have no real visibility into what their people are building.

If you're running an ops team that's using AI to build internal tools, here's your three-point checklist for this afternoon:

1. Inventory what exists. Find every AI-built tool, agent, and workflow touching company data. The 21% blindness stat isn't just an enterprise problem.

2. Check the access model on each one. Who can see what? Is authentication enforced? Are API keys sitting in client-side code?

3. For anything new, pick a platform where governance isn't optional. If security only exists because you remembered to add it, you will eventually forget.

The enterprise security industry will spend the next two years selling AI governance platforms. You probably don't need one. You need a platform that treats access control as infrastructure, not a feature request.