Nearly half (49.8%) of organizations confirmed or suspected an AI agent took an action in the past year that they did not intend, expect, or authorize. Yet only 12.5% can consistently trace an agent's full path, from instruction through tools and APIs to outcome, across all agents.
Based on a survey of over 380 security and technology professionals and Salt Labs production telemetry, this report shows where the gap is widest and how to close it.
What you will take away:
- How widely agents are deployed, with 86.4% of organizations running at least one and 76.8% chaining agents and tools together
- Why most teams can't reconstruct an agent's actions quickly, and why only 17.5% can automatically stop an agent behaving unexpectedly
- How shadow and misconfigured MCP servers are becoming a new attack surface, with 54.3% of organizations having found or suspected one
- What Salt Labs telemetry shows about attackers already targeting agentic-connected APIs in production
Download the State of AI & API 2H 2026 Report to benchmark your program, understand the risks, and learn how to secure what your agents do.
Download the Report!