AI systems are increasingly returning sensitive information to people and agents who are not authorised to see it, with these "downstream" violations more than doubling over the past year.
The finding comes from the Netskope AI Report: 2026, published by Netskope Threat Labs. Downstream violations are now the second most common enterprise AI violation, at 924 of every 10,000 alerts. https://www.netskope.com/resources/threat-labs-reports/netskope-ai-report-2026
Downstream violations occur when an AI service returns information a user or agent cannot access. Their frequency rose from an average of 12 to 31 violations per organisation each week. Among the top 25 per cent of organisations, the rate climbed from 72 to 206 per week.
Netskope linked the increase to rapid adoption of the Model Context Protocol, an open standard that connects AI models and agents to external data and tools. Over ten weeks, users accessing remote MCP servers rose 250 per cent and MCP transactions rose 375 per cent.
Upstream violations, where users send sensitive data to an AI application, remained most common at 8,752 of every 10,000 alerts. Content filtering violations, prompt injection and jailbreak attempts also featured in the data.
Shadow AI persisted, with 30 per cent of enterprise AI users accessing only personal AI applications. Adoption of AI coding tools rose from 42 to 84 per cent of organisations, with Claude Code now used by 75 per cent.
"The 2026 threat landscape has moved beyond shadow AI discovery into a phase of bidirectional, agentic risk," said Ray Canzanese, director of Netskope Threat Labs. He said security teams must treat every agentic interaction as a potential execution vector, not just a data request.