Akamai: Enterprise AI adoption outpaces security controls

Enterprise adoption of AI tools has moved beyond experimentation into daily operations, but security measures have not kept up, according to Akamai’s latest research. The company’s State of the Internet report for 2026 identifies a growing gap between how organizations use AI and the ability of existing defenses to manage the risks. Rather than isolated trials, AI assistants now routinely draft code, analyze data, and perform tasks with minimal oversight, creating new pathways for data exposure and unauthorized access.

The shift has redefined the security challenge. Traditional controls focused on file transfers, downloads, or perimeter breaches are ill-equipped to monitor prompts, browser sessions, or cloud-based AI interactions. Security teams now face visibility gaps before they encounter malware or data leaks, as enterprise data increasingly flows through channels outside established governance frameworks.

Decentralized AI expands the attack surface

Akamai’s report argues that the problem stems less from AI models themselves than from the ecosystems built around them. Developers install browser extensions, employees connect personal AI accounts to corporate workflows, and autonomous agents access email, documents, and collaboration platforms. Each integration improves convenience but also introduces potential entry points for attackers.

The report highlights three emerging attack techniques observed in 2026:

• Vibe hacking: Manipulates local instruction files in development environments to influence coding assistants, causing them to generate insecure code or perform unintended actions without triggering security alerts.
• CursorJacking: Exploits browser extensions with broad permissions to capture API keys, source code, and conversation histories from AI coding tools. Extensions often bypass enterprise approval processes, receiving less scrutiny than traditional software despite their access to sensitive data.
• CometJacking: Uses indirect prompt injection via malicious instructions embedded in public websites to influence browser-based AI agents, potentially granting access to local files, emails, or session credentials.

These methods reflect a broader trend: attackers are targeting trusted automated systems rather than infrastructure directly. The report notes that nearly three-quarters of AI-related browser extensions request high or critical permissions, and over 16% contain publicly known vulnerabilities, making them attractive targets.

Governance and monitoring gaps

Akamai’s findings suggest that AI-related risks are not evenly distributed. A small subset of employees often accounts for the majority of enterprise AI interactions, meaning targeted monitoring of high-frequency users could yield greater security benefits than uniform controls. However, many organizations struggle to track unsanctioned AI services, which often enter workflows outside approved procurement channels.

The report also emphasizes the need for cloud providers and SaaS vendors to integrate AI governance, identity federation, and workload monitoring into their platforms. As AI systems become more autonomous, security controls must shift from protecting networks to governing interactions between users, applications, and data—a perimeter that is increasingly difficult to define.