Nobody can define normal for AI agents, and attackers know it

The baseline problem

Abnormal Security's 2026 State of Security report surveyed 525 cybersecurity leaders across 6 countries, and the headline finding is a confession: nearly half of respondents say they are not at all effective at establishing and maintaining behavioural baselines for AI agents today. Only 54% of organisations maintain behavioural baselines for AI agents at all, and 53% do not establish normal behaviour for machine identities at all. The survey was fielded by AimPoint Group between July and August 2026, and about 85% of respondents hold CISO-level or security operations leadership roles at organisations with 1,000 or more employees — this is not a sample of laggards. m:…3233

The gap matters because detection without a baseline is guesswork. 81% of respondents rely on behavioural anomaly detection to a major or extensive degree, and 90% say understanding why an anomaly triggered is very or critically important to how they respond — yet 51% of teams need four hours or more to fully investigate and remediate a single behavioural detection, and one in ten need at least a full day. Agents that spawn ephemeral sub-agents and clone themselves make the problem worse, because the thing being measured keeps changing shape. The money is moving toward the gap: 43% of surveyed leaders will put their greatest behavioural-monitoring investment into AI agents over the next two years. m:…3233

There is a strange asymmetry in the data. 72% of respondents say their organisation is better prepared to detect anomalous behaviour from non-human identities than from human ones, and 87% say they have mostly or comprehensively operationalised behavioural baselining. Both claims sit next to the admission that nearly half cannot establish a baseline for agents at all. The charitable reading is that the tooling is bought and the practice is not; the uncharitable reading is that teams are reporting the deployment of a capability they cannot yet use. Either way, the baseline is the missing piece. m:…3233

The attack side is not waiting

Pillar Security found a high-severity remote code execution vulnerability in the official Model Context Protocol Inspector, the tool developers use to vet untrusted servers. A remote MCP server could execute arbitrary code on a developer's Windows or WSL machine during the OAuth authentication process, without user interaction. The root cause was the open package, versions 10.x and below, improperly handling URLs in PowerShell, and the flaw was exploitable because auto-open was on by default in an interactive terminal. The irony is sharp: the Inspector's design assumes the server may be hostile, and the tool built to inspect hostile servers was itself the way in. m:…9515

The flaw is tracked as CVE-2026-119025, rated High with a CVSS 4.0 score of 7.7, and maintainers released a fix in version 2.12.0; the fix in version 11.0.0 of the open package escapes the target URL in a single-quoted PowerShell string. But more than 80% of the open package's weekly downloads still resolve to an affected version, and the Inspector is widely used, with 11,000 stars and 768,000 weekly downloads. A fix that most users have not installed is not a fix yet. m:…9515

The economics of attack have moved faster than the economics of defence. AI agents can now build a test lab, write exploits, and compromise targets from an empty workspace in under 4 hours. The average time from vulnerability disclosure to attack fell from 63 days in 2018-19 to 7 days before disclosure by 2025, while the median time to fully fix a known-exploited vulnerability is 43 days, according to the 2026 Verizon Data Breach Investigations Report. The average price criminals paid for access to a victim's network dropped from $1,427 in early 2023 to $439 in early 2026. Small organisations are no longer spared from hands-on attacks, because AI has reduced the cost of every step of the attack chain. The window between disclosure and exploitation is now measured in days, and the fix window in weeks. m:…9287

What the vendors are selling

Cyberhaven's answer is to watch the data, not just the agent. Its Agentic Data Security product extends data security and insider risk protection to AI apps and agents, showing security teams what every agent does with sensitive corporate data and what actions it performs through commands and tool calls. It monitors all MCP tool calls, whether over stdio or network, and ties each agent action to the person or system behind it. The company's labs report that endpoint-based adoption of agentic AI apps doubled between 2025 and 2026, which is both the opportunity and the problem: twice as many agents touching data, with the same visibility gap. m:…2759

The pitch rests on a claim worth stating plainly: AI agents create greater data and insider risk than humans because they act at machine speed and massive scale, often unsupervised. That is the same reason the baseline problem is hard — an agent can do in minutes what a human insider would take weeks to do, and the monitoring budget that 43% of leaders are about to spend is the industry's acknowledgement that the old controls were built for human speed. The question for an executive is not whether to buy monitoring, but whether the monitoring can define normal before the agents redefine it. m:…2759 m:…3233