What do the numbers actually say?

Two reports, six months apart, measuring the same thing from different directions, and they agree.

Gravitee's State of AI Agent Security 2026 report (published 4 February 2026, surveying enterprise security and engineering teams) found 88% of organisations confirmed or suspected an AI agent security incident within the year, and only 14.4% had full security approval for the agent deployments already running in production. Cloud Security Alliance and Token Security, in research published 21 April 2026, measured it more narrowly and still landed high: 65% of organisations experienced at least one cybersecurity incident caused specifically by an AI agent operating on their network, with data exposure the largest single category at 61% of those incidents.

Neither report is measuring a rare event. They're measuring an ordinary one that most organisations have already had, at scale, with security teams watching.

Is this actually relevant to a one-person business, or is it enterprise scare-copy?

Worth being exact about this, because borrowing a big scary number for a business it wasn't measured on is exactly the kind of unsourced-claim habit this newsletter exists to avoid.

Both reports surveyed organisations with dedicated security functions — people whose job is to catch this. You almost certainly don't have that function, which cuts the other way from how it first sounds: an environment with fewer safeguards than the one measured isn't a reason to assume the number doesn't apply to you. It's a reason to assume you'd catch it later, if at all.

What we don't have is a solo-founder-specific incident rate, because nobody runs that survey. What we do have, without needing a survey, is the structural fact underneath both numbers: an AI agent can only cause an incident with access it was granted, and access is granted the same way in a one-person business as in an enterprise — a click-through screen, a scope nobody reads, and a task that felt too small to think about.

Where does the access actually come from?

From launches that were, at the time, reported as good news.

Agents got meaningful file and tool access in July 2026 — the ability to read a connected drive, draft inside a live document, action an email. Covered here as a productivity story, because that's what it was: multi-step work that used to need a human relay now runs inside one tool. Nothing about that coverage was wrong. It's just incomplete on its own, because a capability and a permission are the same grant, and the September numbers are what happens when a summer's worth of those grants sit unreviewed.

The Cloud Security Alliance breakdown makes the mechanism concrete: of the incidents its survey recorded, 43% caused operational disruption and 41% resulted in the agent taking an unintended business action — not malicious use, ordinary use with a scope that was wider than the task needed.

So what's the one-person version of this statistic?

Not "88% chance something goes wrong." That's not what the number measures, and restating it that way would be exactly the kind of unearned figure this brand won't ship.

The one-person version is a question you can actually answer today: of everything you've connected to an AI tool this year, how much of it could you name from memory, with its scope, right now? If the honest answer is "not all of it," you're structurally in the same position the surveyed organisations were in before their incident — not because a breach is coming, but because nobody has looked lately, and looking is the entire fix.

This week's flagship is the 20-minute audit that answers it properly. Tomorrow's post is the specific settings page. For today, the honest move is smaller: name the three AI tools you use most, and try to say — out loud, from memory — exactly what each one can see. If any of the three stumps you, that's your incident statistic, and it's better to find it this way than the other one.

For the guide that finds every place AI already touches your business — free, 5-min read: The 10-Hour Audit.

Related Decodes

• The Agent You Never Approved — this week's hub, and the full 20-minute audit.
• Agents Got File Access in July — the launch these numbers are the follow-up to.
• You Don't Sell the Work. You Sell the Promise Behind It. — what's actually at risk when the promise breaks.
• The 5-Minute Connected-Apps Audit — tomorrow's post: where to actually look.

AI the Brief (@aithebrief) — AI advice you can act on and trust, for time-starved founders.

Not financial or legal advice. The incident figures cited are enterprise-scoped survey data (Gravitee, Feb 2026; Cloud Security Alliance/Token Security, Apr 2026), not a solo-business measurement — they describe a direction of travel, not a probability for your specific setup.

TL;DR: Two 2026 reports — Gravitee (Feb) and Cloud Security Alliance/Token Security (Apr) — independently found that 88% and 65% of surveyed organisations respectively had an AI-agent-caused security incident within the year, mostly from ordinary use with an access scope wider than the task needed. Both surveyed enterprises with dedicated security teams, so the figures don't transfer directly to a one-person business — but the mechanism does: an agent can only misuse access it was granted, and that access is granted the same careless way everywhere, through a click-through scope nobody reads. The honest one-person version of the statistic isn't a probability; it's a question — can you name, from memory, exactly what every AI tool you use is allowed to see? If not, this week's audit is the fix.