I trace the shadow before it casts. That is how I start most audits. Last quarter, IBM's annual cost of a data breach report crossed my desk โ not as a security analyst, but as a DeFi auditor who has spent a decade learning to read the space between code and consequence. The headline figure was $4.99 million, up 12% from the prior year. The US average was $11.5 million, more than double the global mean. These numbers were expected. They were the same inflation-adjusted shock they always are.
Then I hit the sentence that made me stop.
Shadow AI doubled in a year โ from 20% to 43%. That is not a trend. That is a migration. The enterprise endpoint is no longer a human with a laptop. It is an agent with an API key, a memory buffer, and a permission slip signed by no one. The report calls the most expensive category 'agent-native leakage.' I call it the reentrancy attack of the AI era. We have been here before. The code is different. The shape is identical.
This is not an opinion. It is a structural observation. In 2017, I spent six weeks auditing a crowdsale contract that would have drained a treasury through an integer overflow. The bug was not in the visible logic. It sat in the interaction between user-supplied input and unchecked arithmetic. The same pattern is now unfolding across the AI stack. The inputs are no longer uint256 values. They are prompts. The privilege is no longer a function call. It is a tool invocation. And the entity holding the API key is no longer a human. It is a non-human identity, already inside the perimeter.
Finding the pulse in the static means going beyond headlines. The static is the noise of vendors selling fear. The pulse is the underlying shift in how attacks are executed and priced. AI-related breaches cost an average of $1 million more than the global baseline. Model inversion attacks cost $6.07 million per incident. Prompt injection attacks cost $5.89 million. These are not theoretical vulnerabilities discovered in a lab. They are realized losses from real organizations.
The message is not that AI is dangerous. The message is that traditional security architecture โ built around human identities, network perimeters, and static access controls โ is now structurally inadequate for a world in which autonomous agents execute transactions, query databases, write email, and interact with other agents without human oversight at every step. That is the context behind a single acquisition that closed the same week: Cyera acquired Oasis Security for $1 billion, the first billion-dollar acquisition in the agent identity security category.
The Agent Is a Smart Contract with a Language Model
When I audit a DeFi protocol, I ask one question before anything else: what can this contract do, and who gets to make it do it? The answer determines everything else. The same question must now be asked of AI agents. An agent is a software process authorized to act on behalf of an identity. It can read files, send messages, query APIs, and trigger financial transactions. In every meaningful sense, it is a smart contract โ except that it is not deterministic. It does not have a fixed state machine. It has a language model that can be influenced by the content it consumes.
That single difference breaks the trust model of the last twenty years. Traditional IAM lets you authenticate a human and assign that human a role. The human is expected to follow a policy. An agent has no intention. It has inference. It predicts the next token, and if an attacker can control the context โ through a prompt injected into a document, a malicious web page, or a corrupted memory store โ the attacker controls the next action.
Prompt injection is the clearest example. The IBM report ranks it as the second most expensive AI-related attack type, with an average cost of $5.89 million per incident. In smart contract terms, prompt injection is a form of input validation failure that leads to unauthorized state change. The attacker does not need to exploit a compiler bug. The attacker simply asks the agent to do something it has the credentials to do. The agent complies because it is a language model, not a policy engine.
Model inversion is even more interesting. It costs $6.07 million per incident, making it the most expensive category in the report. This attack does not manipulate the agent. It extracts information from the model itself. Through careful querying, an attacker can reconstruct training data, infer parameters, or approximate the decision boundary of the model. In DeFi terms, this is equivalent to an attacker deriving a private key by observing transaction outputs. The model is not just software. It is a repository of valuable secrets, and those secrets are now attackable.
Then there is agent-native leakage. The report does not define the term in detail, but the name is telling. The agent itself becomes the leak. It reads privileged data, and then โ through a tool like email, a database connector, or a browser โ it sends that data somewhere it should not go. This is not a bug in a firewall. It is a failure of authorization at the interaction layer. The agent had permission to read the data. It also had permission to send it. The two permissions, combined in a single autonomous loop, created a bridge that no human ever consciously approved. This is the DeFi allowance attack: one over-scoped token approval and the whole vault is exposed.
I designed a verification layer for AI agents in 2025 that I called 'code-stasis': a human-in-the-loop approval required for high-value autonomous actions. The IBM data validates that design. The most expensive AI-related breaches are not the noisy attacks that trip alarms. They are the quiet ones, where an agent with legitimate access does exactly what it was asked to do, by an attacker who asked it first.
The Permission Model Is the Bug
The most overlooked number in the report is not a dollar amount. It is 92%. Ninety-two percent of organizations that suffered an AI-related data breach lack appropriate AI access controls. That means the technology for controlling agent access exists โ at least in some form โ but it is not deployed. This is not an attack problem. It is a design problem.
In smart contract security, we have a concept called least privilege. We cap allowances. We use multi-sig for high-value operations. We revoke access when a protocol upgrade is complete. In the AI agent world, the equivalent would be scoped API keys, tool allowlists, prompt isolation, and a mandatory human approval for actions above a risk threshold. Very few organizations have implemented any of these.
Why? Because the market is still treating agents as users. The agent is assigned a role in the identity provider, issued a token, and given access to a handful of tools. That works until the agent calls a tool with content that is influenced by an attacker. The permission is not malicious. The permission is just too broad. It was granted for one context and then used in another.
Oasis Security, the startup Cyera acquired, is trying to solve this by building agentic access management. Instead of authorizing an identity once, the system authorizes each interaction: a specific agent, a specific tool, a specific action, at a specific time, in a specific context. That is the same mental model as a DeFi protocol checking msg.sender, function selector, and protocol state before executing a call. The transaction is not valid because it comes from a trusted address. It is valid because it is valid.
Prompt injection thrives in the absence of this model. In Ethereum's history, reentrancy attacks happened because the state update was deferred until after the external call. In AI agents, prompt injection happens because output validation is deferred until after the action. The fix is the same: check everything before the side effect, not after. If an agent can read a privileged document and send it to an external email address in a single tool chain, that is not a model failure. That is a missing authorization boundary.
The 92% figure also explains why the market is willing to pay a billion dollars for a company like Oasis. When the overwhelming majority of breached organizations lack access controls, the addressable market is enormous. The product does not need to be perfect. It needs to exist.
The Cost Data Is a Map, Not a Verdict
The IBM report is not just a list of damages. It is a map of where attackers are allocating their effort. The most important coordinate is the industry distribution: 62% of AI-driven incidents target critical infrastructure, with financial services and energy carrying the heaviest financial costs. This is not random. Attackers go where operational continuity matters most. A hospital or a power grid cannot simply shut down to stop an attack. A bank cannot tolerate a day of fraud. The cost differential reflects that.
The attack type distribution is equally revealing. Deepfakes and impersonation account for 45% of AI-driven events. AI-generated malware accounts for 19%. This is the new attack economy: identity is the target, and trust is the vulnerability. A deepfake is not a technical exploit. It is a social engineering attack amplified by generative AI. It bypasses the human gate that was supposed to catch the anomaly.
From my experience watching the Terra collapse and the DeFi contagion of 2022, I know that when attackers find a channel that works, they pour resources into it until it stops producing. The 56% year-over-year increase in AI-driven attacks suggests that channel is still wide open. Attackers are using AI for reconnaissance, phishing content, malware adaptation, and exploit testing at machine speed. They are not waiting for humans to catch up.
On the defensive side, the report offers a counterpoint. Organizations using AI and automation in security operations save an average of $1.93 million per breach. That is a significant number. It means defensive AI is not vaporware. It has a measurable return. But the ratio matters more than the absolute value. Attackers gained 56% while defenders saved $1.93 million. That is a race with no finish line, and the runner with fewer constraints is winning.
Toward an Interaction Perimeter
The industry still throws 'zero trust' around as if it were a spell. But zero trust was designed for humans. It assumes a human identity, a physical device, a network location, and a predictable authentication flow. Agents do not fit that model. They cannot be asked to approve a push notification. They do not have a biometric fingerprint. Their identity is a secret, and the moment a prompt can alter their behavior, that secret is not enough.
What AI security needs is a new boundary. I call it the interaction perimeter. Instead of asking 'who is this identity?', the system asks 'is this action safe in this context?'. This is not a replacement for IAM. It is a new layer above it, and it requires the ability to inspect each tool call, each model output, and each external content source before execution.
This is where Oasis and its emerging competitors are entering. It is also why Nvidia's Open Secure AI Alliance โ now with 37 members โ matters. GPU and cloud platform vendors want to define the security baseline at the hardware and inference layer. If the model runs on their infrastructure, they can enforce boundaries around its inputs and outputs. For pure software security firms, that is an existential challenge. The security perimeter is moving from the network to the prompt, and from the prompt to the silicon.
I have seen this pattern before. In DeFi, protocols that tried to bolt on security after the fact were the ones that got exploited. Protocols that designed security into the token model, the vault architecture, and the governance mechanism survived. The same will be true for AI. The companies that will win the next decade are not those buying the loudest AI firewall. They are those rethinking authorization from the ground up โ identity, interaction, and inference as a single attack surface.
The Blind Spot: Correlation, Regulation, and the Fear Premium
Now I have to do the part I trained myself to do when the market gets loud. I have to question the signal. The report tells a clear story: organizations with poor AI governance have expensive breaches. The market is responding by paying a billion dollars for an agent identity company. But there is a circularity that nobody wants to name.
The relationship between missing AI access controls and higher breach costs is a correlation, not a proof of causation. Organizations that allow shadow AI to spread unchecked may also have weak security culture, no asset inventory, no incident response plan, and no executive buy-in for security. The missing AI controls might be a symptom of the same disease that caused the breach, not a separate cause. The IBM report does not control for that variable. It cannot, because the data does not include it.
The same caution applies to the Cyera-Oasis acquisition. The $1 billion price tag sets a benchmark, but no ARR, no growth rate, no customer retention numbers, and no revenue multiple were disclosed. A billion dollars can be a fear premium. In my line of work, when a protocol has a large amount of value locked behind an unclear governance structure, I discount it heavily. The same discipline should apply to corporate acquisitions. The first move in a new market is not always the correct one. It is often just the boldest one.
The regulatory picture is even less reassuring. The EU AI Act's high-risk obligations have been delayed by 16 months, to December 2027. Only nine of the twenty-seven member states have designated the competent authorities required to enforce it. This is not a neutral delay. It is a governance vacuum. Attackers are not waiting for a compliance deadline. They are exploiting the gap between technological adoption and institutional response. Every month of regulatory delay is a subsidy for the attacker's side of the balance sheet.
And the deepest blind spot of all: security AI itself is an attack surface. Guardrails, LLM firewalls, policy engines, and access managers are all code. They can be evaded, poisoned, or manipulated. The rush to automate defense may simply create a new generation of vulnerabilities. This is why, in my 2025 framework, I insisted on a human-in-the-loop for high-value actions. Not because I distrusted the model. Because I do not trust any system to secure itself. Vulnerability is just a question unasked. The question is always the same: what happens when the security tool is the one being prompted?
The report also estimates that attackers hold a 31.7% advantage over defenders over a two-year horizon. That number is a judgment call, but it is the most dangerous number in the document. If the attack side is already running faster, then every delay matters. The EU's delay, the product integration delays, the procurement cycles โ all of that is time on the attacker's clock. The defenders are not just behind. They are moving slower.
The Next Terra Is a Chat Window
Logic blooms where silence meets code. I have spent enough time in the void to know that the systems that fail are not the ones with the most dramatic flaws. They are the ones with the most speculative assumptions. Terra failed because it assumed the arbitrage loop would never break. The AI agent stack is currently assuming that a language model will always refuse to do something harmful if it has been 'aligned' โ even when it is surrounded by external content it cannot fully evaluate. That is not a security strategy. It is an allowance with no expiry.
The next Terra will not be a chain. It will be a chat window with too many privileges. The IBM report gives us the cost side of that future: $6 million per model inversion, $5.9 million per prompt injection, $1 million more than baseline for every AI-related breach. The Cyera-Oasis acquisition gives us the market side: capital is now backing the infrastructure to prevent it. But the outcome will be determined by how quickly organizations stop treating agents as users and start treating them as what they are โ autonomous actors that need their own form of access control, their own limits, and their own moment of silence before they act.
In the void, the bytes whisper truth. The truth here is that the most expensive vulnerability in the AI stack is not in the model. It is in the permission. We already learned this in DeFi. We are just surprised to see it in the corporate world. Security is the shape of freedom. The agent that cannot be told to do too much is the agent that can be trusted to do anything. We have not built that agent yet. But the price tags are starting to look like a commitment.
