One agent. One tool. One task, with a human watching the whole time. It works, everyone nods, and it goes to production.
Now here's what production actually looks like. Uber published a paper in May describing the system it built to secure its internal agents, and the operational numbers are the most useful thing in it. Over ten months of deployment: 7,200+ unique hosts, more than 10,000 agent sessions a day. By the time they open-sourced it in July, their CTO was citing 50,000+ sessions daily. Hundreds of credential exposures found across 26 categories: credentials that had quietly left the enterprise network inside agent sessions nobody was watching.
Nobody hand-approved 50,000 things. Nobody read the logs. At that volume the question stops being can the agent do the task and becomes what did fifty thousand sessions do last night, and how would I know.
That is the whole argument. The hard problem in agentic AI was never speed. It's scale.
Speed is the solved problem
The industry has spent two years optimising the wrong variable. Faster models, faster orchestration, faster time-to-pilot. Meanwhile Gartner expects 40% of enterprise applications to embed task-specific agents by the end of this year, up from under 5% in 2025, and predicts more than 40% of agentic AI projects will be cancelled by the end of 2027, with inadequate risk controls named alongside cost and unclear value.
Read those two forecasts together. The same analyst house expects mass deployment and mass cancellation, and the reason for the second is largely that nobody solved the governance side of the first.
The spending pattern says the same thing. Enterprises are putting money into AI capability at a rate that dwarfs what they're putting into securing it. That ratio was survivable when the AI in question answered questions. It is not survivable now that the AI has credentials, tools and a shell.
Why scale changes the maths, not just the workload
Here's the part that makes agentic security genuinely different, and it's a probability argument rather than a technical one.
Anthropic's own system card measured indirect prompt injection against an agentic coding environment. A single attempt succeeded 4.7% of the time. Ten attempts: 33.6%. A hundred: 63.0%. The International AI Safety Report 2026 found sophisticated attackers get past the best-defended models roughly half the time within ten attempts.
A 95% per-attempt defence rate sounds like a pass. It is a pass, at demo scale. At 50,000 sessions a day, against an adversary for whom retries cost nothing, it's a schedule.
This is why "we tested our agent and it refused the bad prompt" is not evidence of anything. You didn't test the agent. You tested one sample from a distribution you'll be drawing from ten thousand times a day, forever, while an attacker adjusts the payload between draws.
And the underlying flaw isn't getting patched. An OWASP contributor put it plainly at Infosecurity Europe this year: prompt injection is unsolved at the architectural level, because models process everything as one token sequence and there's no reliable way to enforce a privilege boundary between the system prompt, the user's request, and whatever a webpage the agent just read happens to say. It has been the number one entry on the OWASP LLM Top 10 since 2025 and it is still there.
Four tiers, twelve pillars
If you accept that the surface is the problem, you need a map of the surface. The most complete one we've seen breaks into four tiers and twelve pillars, and it's worth walking because most enterprise AI security programmes cover about three of them.
Secure the inputs: input security, identity and access control, data protection, model security. This is where the identity story lives, and the identity story is out of control. Estimates of the non-human to human identity ratio range from 45:1 to over 100:1 depending on whose survey you read, and cloud-native environments run higher. Palo Alto's 2026 survey of nearly 3,000 security decision-makers found roughly 90% of organisations had at least one identity-related breach in the previous year, with AI agent identities projected to grow 85% over the following twelve months. The Cloud Security Alliance found 92% of organisations say their existing IAM tooling cannot manage agent identities at all. Meanwhile the 2026 Verizon DBIR reported unapproved AI tool use tripling to touch 45% of the workforce, and every one of those shadow deployments mints credentials nobody inventories.
Secure the intelligence: prompt security, RAG security, tool and MCP security, memory security. MCP is the load-bearing example. Censys counted 12,520 internet-accessible MCP services in late April, and over 21,000 by early May. A large-scale measurement found roughly 40% of remote servers expose their tools with no authentication whatsoever. An audit of 5,200+ servers found 88% require credentials, 53% rely on static API keys or personal access tokens, and only 8.5% use OAuth. Academic work called VIPER-MCP swept nearly 40,000 server repositories and surfaced 106 zero-days. The protocol was designed for local, trusted-network use and never required auth; the ecosystem shipped it to the public internet anyway.
Memory belongs in this tier for a reason people underrate. Poison a prompt and you own one session. Poison persistent memory, hooks or an MCP config and you own every future session, silently, until someone thinks to look.
Secure the agents: coordination and conflict resolution between agents, and continuous observability. The Uber paper is sharp on why existing tooling fails here: EDR sees the file write, but not the reasoning, the prompt, or the causal chain linking intent to execution. You get the effect without the cause. Try building a detection rule on that.
Secure the enterprise: AI supply chain, and governance, evaluation and alignment. This is the tier that decides whether the other eleven are true in production or only true on paper.
Twelve pillars is a lot. It's also the honest number. Anyone selling you a single control that covers agentic risk is selling you one pillar and hoping you don't count.
Someone finally ran this at scale and published it
The reason we keep coming back to Uber's ADR is that almost everything else in this space is a pitch. This is ten months of production telemetry with a paper and an Apache-2.0 repo attached.
Three parts. A sensor that captures agent telemetry at the reasoning level rather than the syscall level. A two-tier detector: cheap high-recall triage first, expensive agentic reasoning only on sessions that look suspicious, because running an LLM over everything is financially absurd at 50,000 sessions a day. And an offline red-teaming engine for pre-deployment hardening, which is the piece they kept back.
The results they published: hundreds of credential exposures across 26 categories, and a shift-left prevention layer hitting 97.2% precision, catching 206 of 212 unique credentials across hundreds of thousands of sessions.
They also shipped the benchmark, which is arguably the more valuable release. ADR-Bench: 302 realistic business tasks, 133 MCP servers exposing 729 tools, averaging 28.5 tool calls per task, covering all 17 attack techniques across 5 tactics. Prior benchmarks covered three to six of those seventeen. On it, ADR detects 67% of attacks at zero false positives, beating ALRPHFS, GuardAgent and LlamaFirewall by 2-4x on F1.
Sit with that 67% for a second, because it's the most important number in the paper and it isn't the flattering one. This is the best production-proven agentic detection system anyone has published, run by a company with a real SOC and ten months of tuning, and a third of the attacks still get through. If your internal position is that your guardrail catches everything, you are not ahead of Uber. You are unmeasured.
Which points at the free thing you should do this quarter: run ADR-Bench against your own defences. It's a ready-made external eval harness with a real threat framework behind it, and it will tell you a truer number than any vendor datasheet. Run it isolated: the fixtures include live prompt-injection payloads, synthetic credentials and deliberately vulnerable emulated servers, and dependencies are pinned to versions with known CVEs for reproducibility.
Where the rest of the world has got to
The collective response arrived in late July. NVIDIA and 37 organisations launched the Open Secure AI Alliance, explicitly citing the Hugging Face incident as the reminder that defenders need frontier security tooling they can run themselves. Uber joined. So did Microsoft, IBM, Red Hat, CrowdStrike, Cisco, Cloudflare, Hugging Face and the Linux Foundation. Membership has since grown past 120, and the group has proposed a shared incident and near-miss exchange so failures get pooled rather than buried.
Two things worth noticing. Google, Anthropic and OpenAI were not on the founding list. And the alliance's own framing is that an agent is not a model: it's a stack of model, harness, tools, identity, permissions, isolation, guardrails, logging and evaluation, and security is a property of the whole thing. That is the same four-tier argument from a different direction.
The sceptics have a point too, and it's worth stating rather than skipping: open tooling doesn't constrain an adversary running an unrestricted model on their own hardware. Once a model is operating in isolation, safety controls are just software that can be removed. Shared defensive infrastructure helps defenders. It doesn't disarm anyone.
So the honest state of play, as of August 2026: the attack surface has a map, the first production-scale detection system is public, there's a benchmark to measure yourself against, an industry coalition exists, and the single most exploited weakness in the stack still has no fix.
What this means if you run agents
You cannot buy your way out of this, because the thing that fails is rarely the product. It's the gap between what your controls do at demo scale and what they do at session ten thousand, on a Tuesday night, against input nobody reviewed.
That gap has a shape you can measure. What agents exist, what identities they hold, what tools they can reach, what their memory has absorbed, what they actually did, checked continuously against what you told your board they were allowed to do.
That's the problem Tahara is built for. But the benchmark is free, the paper is public, and the first honest number about your own defences is available to you this week. Start there.