AI Systems Return Data—An Underestimated Security Risk
The Netskope Threat Labs AI Report 2026 shows that the real AI security risk is increasingly coming from the opposite direction. So-called downstream violations have more than doubled within a year. The driving force behind this is the Model Context Protocol, whose transactions have risen by 375 percent in just ten weeks.
For years, security professionals have focused on what data leaves their companies for AI systems. The Netskope Threat Labs AI Report 2026 now shows that this perspective is too narrow: The real risk is increasingly coming from the opposite direction. AI systems are returning sensitive data—to users or agents who should not have access to it at all.
Downstream violations have more than doubled
These so-called downstream violations have more than doubled within a year, rising from an average of 12 to 31 per week per company. Among the 25 percent of organizations most affected, the number even rose from 72 to 206. This makes downstream violations the second most common AI risk category: Out of 10,000 AI alerts, 924 are such cases—nearly one in ten. The only more common type are upstream violations, in which users send sensitive data to AI services (8,752 out of 10,000). These are followed by content filtering violations (154), prompt injection and jailbreak attempts (129), and targeted requests for sensitive data (28). Malicious code, with five warnings per 10,000, constitutes the smallest but also the most critical category—an autonomous agent can execute it directly or incorporate it into a larger codebase.
MCP as a Key Growth Driver
A key reason for this trend is the explosive growth of the Model Context Protocol (MCP), which enables AI models and agents to connect to external data sources and tools. In just ten weeks, MCP transactions rose by 375 percent, and the number of users increased by 250 percent. Among the most important MCP clients are the coding agents Claude Code and Codex.
Autonomous coding is becoming the standard
Claude Code is now the most widely used code platform and is deployed in 75 percent of companies; Codex follows with 58 percent. A year ago, both were still below one percent. The share of companies using AI-powered coding applications rose from 42 to 84 percent. While IDE-based assistants such as GitHub Copilot and Cursor are stagnating, the market is shifting toward tools that generate and execute code autonomously.
Shadow AI is here to stay—the trend has reversed
Contrary to industry expectations, AI usage is not consolidating on open platforms. The decline in private applications ended in March 2026 and has since reversed slightly: 56 percent of users rely exclusively on managed applications, 30 percent exclusively on private apps, and 14 percent use both. Instead of migrating every use case, companies are increasingly relying on guidelines. At the same time, the scope of detection has expanded: from private chatbots to AI agents, MCP servers, and local AI infrastructure.
Data Sovereignty: Two out of five companies run models locally
41 percent of companies run AI models locally using the open-source framework Ollama to maintain control over where processing takes place and reduce cloud costs. Google’s Gemma4 leads the way (42 percent), followed by Alibaba’s Qwen and Meta’s Llama. Those who run models on-premises gain control over where processing takes place—but not automatically over the interactions. For this reason, on-premises AI infrastructure should also be connected to a central AI gateway.
Other key findings from the report
Regulated data and source code each account for 35 percent of upstream violations, followed by intellectual property (20 percent) and passwords and access keys (10 percent), which most often appear embedded in source code or configuration files. At the platform level, the number of users rose from 51 to 92 percent of all companies. Anthropic’s Claude Platform has replaced OpenAI as the leading provider; Amazon Bedrock follows far behind in third place. The average prompt volume tripled from 1,498 to 4,731 per week per company, reaching at least 19,292 in the top quartile. The median percentage of weekly AI users climbed from 34 to 59 percent. In addition, attacks on the AI supply chain are on the rise: Fake AI lures—including fake installers and Trojanized developer tools—spiked in March 2026 and have remained at elevated levels ever since.
«Bidirectional, agent-based risks»
«The threat landscape in 2026 has moved beyond the phase of purely detecting shadow AI and has entered a stage of bidirectional, agent-based risks,» explains Ray Canzanese, Director of Netskope Threat Labs. «We’ve long since moved beyond simply monitoring the prompts that employees send to external models. We’re now managing the integrity of the AI supply chain. The rapid adoption of the Model Context Protocol directly connects internal data stores with external agents, while the surge in autonomous coding tools like Claude Code and Cursor has drastically lowered the barrier to automated execution of malicious code. For security teams, this means a shift: away from pure data control and toward bidirectional inspection. We must view every agent-based interaction as a potential execution vector, not merely as a data query.»
The analysis in this report is based on aggregated usage data from the Netskope One platform for a subset of Netskope customers during the period from June 2025 to July 2026.
More information: www.netskope.com
This article originally appeared on m-q.ch - https://www.m-q.ch/de/ki-systeme-geben-daten-zurueck-ein-unterschaetztes-sicherheitsrisiko/
