Anatomy of
AI Agent
Breaches.

We dissected the AI agent and non-human identity breaches of 2026. In almost none of them is identity governance how you stop the attack from starting. In most of them, it is how you stop the attack from mattering.

We pulled every 2026 breach, disclosed attack, and named vulnerability we could verify where an AI agent or a non-human identity sat in the chain. We threw out the ones we could not source. What remains is 38 confirmed incidents. This note takes the strongest of them apart, one at a time, and then does something most vendor writing avoids: it tells you honestly where our layer would have changed the outcome, and where it would not.

A method note first, because it is the point. This is a foundational companion to FN-05, which maps the ten identity gaps beneath every enterprise AI agent. Every incident below is one of those gaps happening in production. For each featured case we give three things: the technical anatomy, the same thing explained as if to a twelve-year-old, and an honest Arkion verdict.

The Shape of a 2026 Agent Breach

Read 38 of these back to back and a shape appears. The thing that fails first is almost never identity. It is a prompt injection, a sandbox or parser bug, a poisoned dependency, or a server-side misconfiguration. Those are not our layer, and we will say so every time. But the thing the attacker is actually after, and the thing that turns a single foothold into an estate-wide incident, is almost always a non-human credential.

Two sub-patterns carry most of the corpus. The first is the credential as the prize. Every supply-chain and MCP compromise here (node-ipc, LiteLLM, the Axios and TanStack npm incidents, the typosquat campaign, the poisoned GitHub Action) exists for one reason: to harvest API keys, OAuth tokens, cloud roles, and publish tokens off developer and CI machines. The delivery is the exploit. The payout is the standing secret.

The second is the standing, over-scoped identity as the pivot. Klue, Vercel, Storm-2949, the AWS eight-minute takeover, PocketOS, the AgentCore escalation. In each, the damage flows through a long-lived, over-permissioned machine identity, whether an intruder inherits it (Klue, Vercel, Storm-2949, the AWS takeover) or an agent misuses its own standing credential (PocketOS, the AgentCore escalation). No malware required, because the credential was already trusted and already too powerful.

Nine Breaches, Taken Apart

Where Identity Governance Does Not Help

The honest column in the table below is the one that reads “not addressed,” and there are 10of them. They cluster tightly. Cursor DuneSlide, the Gemini CLI and Copilot CLI command-injection flaws, Microsoft 365 Copilot SearchLeak, Copilot Studio, the LiteLLM pre-auth SQL injection. These are code vulnerabilities, sandbox escapes, and prompt injections that execute under a human’s own session or exploit a vendor’s server-side endpoint.

There are four things a non-human identity layer structurally cannot do, and almost every “not addressed” verdict traces to one of them. It does not inspect prompts or tool-description metadata. It does not sit in the agent’s reasoning loop, so it stops no injection, jailbreak, or hallucination. It does not patch code, sandboxes, parsers, or a vendor’s endpoints. And it does not run on the developer’s laptop or govern a human’s local operating-system session. Any vendor who tells you their identity product would have blocked AgentJacking or SearchLeak is selling you something.

The Tally, Stated Plainly

Across 38 confirmed incidents, the number that identity governance would have prevented or blocked outright is zero. That is not a soft number. Prevention is not what this layer does. What it does is change the outcome after the initial failure:

Read the honest way: in the 10 contained cases, governing the non-human identity changes the outcome outright, it shrinks the blast radius, shortens dwell time, and enables fast revocation. In the 18 mixed cases it can, depending on how the identity was deployed and scoped. In 10, it does not. We would rather tell you that than sell you a prevention story the evidence does not support.

The Full Corpus

Every 2026 incident we verified, with its date, our honest verdict, and a primary source. A note on completeness: during research, part of our supply-chain sweep was interrupted, so the npm and PyPI section is likely undercounted. This is a floor, not a ceiling.

Closing

The industry keeps writing about how to make agents reason more safely. That work matters, and it is not our work. Read this corpus and a different, quieter conclusion holds: the model is rarely the target, and prevention of the first failure is rarely available. The credential is the target, and containment is available right now.

You cannot stop every agent from being tricked, every dependency from being poisoned, or every key from leaking. You can make sure that when one of those happens, the identity underneath is scoped, short-lived, signed, and revocable, so the incident is something you close in seconds instead of something you read about for a year.