With AI adoption surging, at the beginning of 2026, ESET cybersecurity researchers and analysts sought to make several predictions about how artificial intelligence would shape the threat landscape in the upcoming 12 months. Many of these forecasts focused on the rapid adoption of AI agents, the growing use of public AI models, the emergence of AI-assisted cybercrime, and the expanding role of AI in mobile threats.
Six months into the year, the available data suggests that many of these predictions were accurate and have been completely or partially fulfilled. Organizations continue to implement AI at breakneck pace to keep up with competitors, while security remains an afterthought, creating new opportunities for attackers and introducing complex security challenges across organizations’ environments.
Key points of the article
- AI adoption continues to outpace security controls for AI in most organizations.
- Shadow AI remains a significant risk, with businesses often lacking policies on authorized and unauthorized AI use.
- AI, and especially autonomous AI agents, are expanding known and opening a completely new attack surface through complex integrations and cloud connectivity.
- AI supply-chain risks are growing as organizations deploy third-party agents, plugins, and models.
- AI has significantly improved both quality and quantity of low-complexity cyberattacks and both phishing and scams.
Security of AI agents
We expected AI agents to become deeply embedded in enterprise and cloud infrastructures in 2026, despite their security remaining alarmingly weak. So far, this prediction has proven correct.
Organizations continue to struggle with basic questions about where AI agents fit within their architectures and how to securely manage their connections to cloud services. In the pursuit of efficiency and pressure from competition, many companies are repeating mistakes made during the early days of the internet and social media by prioritizing convenience over security.
According to the ESET SMB Cyber Readiness Index 2026 based on data collected between February and March 2026, 73% of surveyed businesses are integrating AI technologies. However, 40% do not have policies restricting the use of AI applications outside approved processes or platforms, creating opportunities for shadow AI to open the doors to increased risk.
Image 1. Use of shadow AI. ESET’s 2026 SMB Cyber Readiness Index
We also correctly anticipated that widespread AI adoption would significantly expand the attack surface. AI agents interact with systems in complex and often unpredictable ways, and even minor misconfigurations can lead to serious data breaches or unauthorized access.
AI software supply-chain risks placed among Forrester’s top cybersecurity threats for 2026 list published in June.
We were also correct in predicting the increasing popularity of AI marketplaces and agent repositories. These ecosystems create additional security challenges because malicious actors can clone or subtly modify legitimate AI agents, making detection and trust management difficult.
For example, in mid-June 2026, JetBrains received reports of about 15 third-party plugins on the JetBrains Marketplace masquerading as legitimate AI utilities that were actually built to steal AI-provider API keys configured by users. Just as developers use JetBrains’ and others’ tools to simplify and accelerate their work, individual users creating and improving AI Agents can also introduce similar risks.
With respect to AI, one vector of those risks can be realized by attackers abusing AI skills (plugins or add-ons for AI assistants) that expand functionality. The latest ESET Threat Report H1 2026 shows that between March and May 2026, during which ESET analyzed 900,000 AI skills from popular repositories, we found that 25,000 skills were suspicious and over 3,000 were malicious.
Addressing threats vectoring from AI Skills was ESET’s jumping-off point in deploying practical protections for the AI Era.
Immediate mitigation of this threat type resulted in our ESET AI Skills Checker, which scans publicly available AI Skills before installation. It identifies malicious activity, unnecessary permissions, risky behavior patterns, and suspicious functionality. *ESET Skills Checker is also the source of the telemetry data above.
Security of models
Furthermore, model repositories represent yet another attack surface, as demonstrated by several OpenAI models breaking free during internal tests and attacking the open-source AI platform Hugging Face.
It was not difficult to predict that the ecosystem of publicly available AI models would continue to expand in 2026, with millions of models available worldwide. The open-source ecosystem on Hugging Face, for example, grew from one million public models to two million between October 2024 and September 2025. However, many of these models are distributed as open-weight packages with unknown internal logic and limited transparency regarding training data.
We predicted that organizations would increasingly deploy these models as black boxes, often under time pressure and without adequate security validation and governance. This approach is ripe for the introduction of hidden vulnerabilities, privacy concerns, and compliance risks into enterprise environments.
The lack of transparency also amplifies supply-chain risks. Malicious or compromised models can become embedded within larger AI workflows, potentially bypassing traditional security controls. Also, previously safe models can become a threat due to harmful updates or dependencies gradually altering agents’ behavior. As a result, the industry is facing a growing number of attacks that exploit these weaknesses, forcing organizations to reconsider how they establish trust and verify AI components.
Fresh data from mid-2026 already confirms our predictions; according to the DigiCert report published in June, 78% of organizations across the United States, United Kingdom, and Australia have either experienced an AI-related security incident or identified an AI-related vulnerability. At the same time, organizations continue to deploy AI technologies at a rapid pace. Overall, 75% reported deploying four or more AI tools since the beginning of 2026, while 35% reported deploying more than ten.
The lack of visibility is equally concerning. Nearly half (47%) of surveyed organizations admitted they cannot fully trace AI-generated decisions back to the models and source data responsible for them. While risks vectoring from AI aren’t going anywhere anytime soon, there are opportunities for even small businesses to benefit from powerful resilience building tools like managed detection and response (MDR). It is a service combining automation and human expertise to rapidly detect and respond to new threats, removing the need to maintain in-house security specialists.
ESET Managed Detection and Response (MDR) is a 24/7 cybersecurity service that combines AI-powered automation, human expertise, and ESET’s threat intelligence to continuously monitor, detect, investigate, and respond to security incidents, including incidents related to use of AI.
Malicious use of AI
We expected the direct use of AI to generate malware and scripts to remain limited and specific, while the most significant impacts vectoring from AI would be seen in social engineering attacks.
By the summer of 2026, one year after ESET discovered the AI-powered ransomware PromptLock, malware samples actively using AI during runtime execution remain rare.
As predicted, the most significant challenge has been the continuing surge in high-quality AI-generated social engineering content. Deepfakes, phishing emails, and malicious advertisements have become increasingly convincing, enabling even low-skilled attackers to conduct large-scale scams at a low cost.
A clear example is ClickFix, a social engineering technique that presents victims with a fake problem and then offers a supposed solution. The “fix” is actually a set of instructions that tricks users into executing malicious commands or scripts on their own devices, ultimately leading to malware infections.
According to the ESET Threat Report H1 2026, between mid-December 2025 and the end of May 2026, ESET telemetry detected 108% more ClickFix samples than during the previous period between June 2025 and mid-December 2025. This increase has been driven in part by cybercriminals utilizing AI tools to create convincing websites, realistic error messages, and even fake troubleshooting AI chatbots.
Image 2. A web page abusing Anthropic’s Artifact pages domain to spread ClickFix instructions
AI threats and smartphones
At the beginning of 2026, we anticipated a growing number of Android malware families leveraging generative AI tools. It took only a few weeks for researchers to confirm this trend.
In February 2026, ESET published research on PromptSpy, the first known Android malware family to incorporate generative AI into its execution flow to gain persistence.
We also predicted a rise in NFC-based scams designed to steal NFC data and create functional copies of victims’ payment cards. We expected attackers to enhance these operations with AI-generated content and tooling.
ESET telemetry shows that the number of NFC scams has grown dynamically between 2023 and 2025 but saw a minor decrease in H1 2026. Still, the evolution of NFC-related threats continues as demonstrated by a new version of the NGate malware discovered by ESET researchers that abused the legitimate Android application HandyPay. Evidence suggests that threat actors likely used generative AI when trojanizing the application, including AI-characteristic emoji patterns found in operational logs.
AI-powered online bots as a threat
We expect AI-powered online bots to reach new levels of sophistication throughout 2026. These bots should likely become capable of generating highly convincing fake reviews, impersonating real users, and creating realistic social media profiles that can manipulate hiring processes, support fraud campaigns, conduct extortion schemes, and influence public opinion.
The recent news confirms this prediction as AI chatbots now outperform humans in building trust for scams, according to a study conducted by researchers from four universities based in India, Italy, Israel, and the United States.
Conclusion
Halfway through 2026, many of the major security predictions about artificial intelligence have already proven accurate. AI is accelerating business innovation, but it is also expanding the attack surface, creating new intrusion vectors, increasing software supply-chain risks, and enabling sophisticated social engineering campaigns. While truly autonomous AI-powered malware remains uncommon, threat actors are successfully leveraging AI to improve the scale, quality, and effectiveness of their operations.
The findings highlight a growing gap between AI adoption and AI governance. As organizations continue deploying AI, stronger security controls, visibility, model validation, and risk management practices will be essential.
Frequently asked questions (FAQs)
What is shadow AI?
Shadow AI refers to the use of AI tools, applications, or services that operate outside an organization’s approved policies, governance processes, or security controls.
Why are AI agents considered a security risk?
AI agents often connect to tools, internal data sources, internal and external systems, APIs, and cloud services. Poor configuration, excessive permissions, or compromised integrations can lead to unauthorized access, data leakage, and expanded attack surfaces.
What are AI supply-chain risks?
AI supply-chain risks arise when organizations rely on third-party models, plugins, datasets, or agents that may contain vulnerabilities, malicious code, or hidden functionality that has not been adequately vetted.
Is AI-generated malware becoming common?
Not yet. While researchers have identified malware families that use AI capabilities, the most significant impact of AI in cybercrime currently remains social engineering, phishing, fraud, and abuse of the expanding attack surface, rather than fully autonomous malware.
Why is AI transparency important?
Organizations need visibility into which models generated a specific output, what data was used, and how decisions were made. Without transparency, security incidents, compliance risks, and biased outcomes become difficult to identify and manage.
How are attackers using AI in phishing campaigns?
Attackers use AI to create more convincing emails, fake websites, deepfakes, chatbots, advertisements, and social engineering content. This reduces their costs and enables large-scale campaigns with highly personalized messages.
What should organizations prioritize when securing AI deployments?
Organizations should establish clear and understandable AI governance policies, restrict shadow AI, assess third-party models and agents, implement access controls, monitor AI activity, validate AI outputs, and maintain visibility across their AI ecosystem.
