The state of AI security in 2026

This excerpt from the 2026 Threat Detection Report outlines the growing use of AI by both attackers and defenders: adversaries (including nation-state actors) are leveraging LLMs and MCP servers to automate reconnaissance, phishing, and espionage while attackers also target AI infrastructure via prompt injection and model hijacking; the report recommends defense-in-depth measures—least privilege, credential management, supply-chain vetting, environment segmentation—and advocates human-guided AI agents in SOC workflows to accelerate detection and response without removing human oversight.