newsfilter
← Latest News
GlobeNewswire·

Akamai Research: Nearly Half of Enterprise AI Use Bypasses Corporate Security, Creating Massive “Shadow AI” Visibility Gaps

AKAM
  • Akamai released its 2026 State of the Internet security report highlighting risks from rogue browser extensions & vulnerable autonomous agents.
  • A small group of highly active "AI power users" drives the majority of enterprise AI exposure & risk.
  • "Shadow AI" creates a severe visibility gap as a massive long tail of unmanaged apps operates beneath approved platforms.
  • Researchers identified three novel AI-native attack vectors in 2026 that bypass traditional perimeter defenses: Vibe hacking, CursorJacking, & CometJacking.
  • Vibe hacking manipulates local markdown files to trick coding assistants into generating insecure outputs or executing unauthorized actions.
  • CursorJacking uses rogue browser extensions to silently harvest API keys, codebases, & conversational history from AI coding assistants.
  • CometJacking employs indirect prompt injection via public web pages to manipulate agentic browsers into exfiltrating local files & credentials.
  • Corporate AI adoption has shifted from experimentation in early 2025 to a structural mandate that outpaced traditional security guardrails.
  • Akamai outlines five mitigation strategies for CISOs: target high-risk power users, eliminate shadow AI via SSO federation, inspect the interaction layer, vet browser/IDE extensions, & secure AI agents with least-privilege boundaries.
  • Nearly 75% of AI extensions demand high or critical permissions, with 16.3% containing known CVEs.
  • Traditional data loss prevention tools are deemed insufficient for protecting data fragmented across fluid prompts, unmanaged accounts, & autonomous agents.