17 Percent Report AI-Assisted Attacks, 11 Percent Have an Incident Process

On October 7, 2026, the Bundesamt für Sicherheit in der Informationstechnik (BSI, Germany’s Federal Office for Information Security) and the TÜV-Verband (German technical inspection association) presented the AI Security Study 2026; 505 companies with 20 or more employees were surveyed. 17 percent report an AI-assisted cyberattack or fraud attempt over the past twelve months — broken down, 4 percent confirmed, 11 percent suspected, 2 percent both.

The counter-figure is the more interesting one. About one in ten companies has specific protective measures in place, and only 11 percent of those using or planning to use AI have an incident process; the publishers expect a considerably higher number of unreported cases. The news is not that such attacks will arrive at some point, but that they are here and there is no plan for the event.

At a glance

• What the study says: 17 percent of 505 surveyed companies report an AI-assisted attack or fraud attempt within twelve months — 4 percent confirmed, 11 percent suspected, 2 percent both.
• What follows: About one in ten companies has protective measures, 11 percent an incident process; above that, per the publishers, sit more unreported cases.
• The catch: The new attack surface is the prompt layer, not the model — and it is containable through narrow permissions at the tool.

The figures, read with their distinctions

Suspected cases are not confirmed cases; the sum of the two is not a case count.

On adoption: per a Bitkom survey from late September 2026, a majority of companies with 20 or more employees now use AI for the first time — 57 percent among 603 respondents, up from 36 percent a year earlier. These are self-assessments; the survey has no measured productivity metrics.

Two dated incidents, and where they point

GitLab AI Gateway, October 2, 2026, CVE-2026-90970. It is reported that an authenticated user was able to craft a flow configuration that escaped the sandbox for prompt templates and executed commands on the gateway; the patch was published the same day. What broke is the most inconspicuous place in the setup: the text template from which the prompt is assembled. That account comes from a community collection, not from the GitLab advisory.

Browser agents in the field, October 2026. Palo Alto Unit 42 reports having observed web-based indirect prompt injection against browser agents in practice, and adds: long conversation histories make agents more susceptible. That is vendor research with unclear dating.

The pattern is older: at the agent platform Manus, in September 2026 a prompt injection delivered by email led, according to Salt Labs, to code execution and the theft of credentials for Gmail, GitHub and Dropbox. That is the entire chain in one sentence — external content, agent, connected accounts.

The prompt layer is a trust boundary

Everywhere else the principle is well drilled: input from outside is checked before it triggers anything. With the prompt it gets skipped, because a prompt does not feel like input but like a conversation. External content an agent reads — the web page, the client email, the PDF — can contain instructions, and the model does not separate data from commands. Treat the prompt layer as “just text” and you have not drawn the boundary, you have merely failed to see it. The GitLab case shows it from the other side: there the problem was not the input but the template framing it.

Three objections worth hearing

First: 17 percent is not an impressive number. True, and it rests on soft ground — self-reported, two thirds of it suspected cases. But the error runs both ways: whoever has no detection reports nothing either.

Second: “AI-assisted” is a broad category. For 90 percent of those affected it means phishing — an old attack model at lower cost, against which approval rules help, not AI security technology. The October incidents sit on a different level and hit only those who let agents reach tools and accounts.

Third: the sourcing on the incidents is softer than the study figures. The CVE account comes from a community collection, the browser-agent finding is vendor research — good enough as a pattern, not as a number in a risk report.

Almost everything from outside stops at the trust boundary — until one piece of external content crosses it and carries on, beyond the line, as an instruction.

What this means for your business

Treat prompt templates and flow configurations like code. Version control, review, and the version state of your AI gateways belongs in the same patching routine as the rest of your infrastructure — in the GitLab case the patch was ready on the day of disclosure, which only helps if someone applies it. That needs a maintenance budget.

Restrict at the tool, not in the prompt. The minimum hardening from these cases: a separate identity with narrow permissions per connected service instead of the user’s token, read access as the default, human confirmation for anything with outward effect — payments, emails, deletions —, bounded conversation histories, and internal accounts inside the threat model, because in the GitLab case an authenticated user was enough. Anyone pointing agents at client mail should also settle who is liable; one level below sit the credentials of the development environment.

Write down the incident process before you need it. Four answers suffice: who notices it, who decides, how is an agent or an access path shut off, whom do you notify within what deadline. Add the list of connected services per agent, otherwise it is unclear which accounts to lock — a section in your AI policy, not a project.

Conclusion

The study does not document a wave but a gap: more reported exposure than preparedness, with unreported cases above both figures. The hard part is not the technology — the minimum hardening above costs days, not budgets — but the decision to treat the prompt layer as suspiciously as any other input field. There is still no binding audit catalogue for agents; a separate article will follow.

If you want to know how your AI tools fare against this grid, let’s talk. I assess such questions as a business lawyer and run the tools myself.

FAQ

What does the AI Security Study 2026 by BSI and the TÜV-Verband say?

Presented on October 7, 2026, based on 505 companies with 20 or more employees. 17 percent report an AI-assisted attack or fraud attempt over twelve months: 4 percent confirmed cases, 11 percent suspected cases, 2 percent both. About one in ten companies has specific protective measures in place, and only 11 percent of firms using or planning AI have an incident process. Phishing was involved for 90 percent of those affected.

What does indirect prompt injection mean for a company?

An agent that reads external content also reads instructions someone has placed there for it. Palo Alto Unit 42 reports such attacks against browser agents in the field for October 2026; long conversation histories make agents more susceptible. The damage can be contained through narrow permissions at the tool.

What happened in the GitLab AI Gateway incident (CVE-2026-90970)?

It is reported that on October 2, 2026, an authenticated user was able to craft a flow configuration that escaped the prompt-template sandbox and executed commands on the gateway; the patch was published the same day. That account comes from a community collection, not from the advisory.

What belongs in an incident process for AI security events?

Four answers, written down before the first incident: who notices it, who decides, how is an agent or an access path shut off, and whom do you notify within what deadline. Add a list of the connected services per agent, otherwise it is unclear which accounts to lock. According to the study, 89 percent of the firms with an AI connection lack exactly that.

---

Sources — as of 2026-10-08

• BSI and TÜV-Verband, AI Security Study 2026 (2026-10-07, primary source) — https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2026/261007_KI-Sicherheitsstudie_TUEV_BSI.html
• Bitkom survey on AI adoption — https://www.handelsblatt.com/technik/it-internet/bitkom-studie-mehrheit-der-unternehmen-nutzt-ki-bedenken-bleiben/100254357.html
• Palo Alto Unit 42, prompt injection against agents — https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
• CVE-2026-90970 (GitLab AI Gateway), community collection — https://github.com/webpro255/awesome-ai-agent-attacks
• Manus incident (Salt Labs, September 2026) — https://aviatrix.ai/threat-research-center/manus-prompt-injection-vulnerability-2026/

On sourcing: the study figures from the BSI primary source are solid. The Bitkom figure rests on self-assessments; a circulating divergent adoption rate was not reliable and is omitted. The CVE account comes from a community collection; Unit 42 and the Manus case are vendor research with unclear dating.

This article is general information and not legal advice for an individual case. As of October 8, 2026; please check the current state before making decisions.