Ask AI about us
AI agents execute commands, access sensitive information, and make changes across enterprise systems. But how much of that work stays within the task they were given?
Drawing on approximately 24 million invocations across tens of thousands of observed agents, Tego AI’s 2026 Security Report examines how agents actually operate and where security controls need to catch up.
Download the Report80.6%
of observed tool calls used native execution.
Security controls focused solely on MCP traffic cover only part of agentic activity. Command execution, file reading and writing, and network access extend agents’ reach across the enterprise and must be part of the same security program.
77.3%
of observed tool calls used native execution.
Reviewing only the user’s request and the agent’s final response leaves much of execution unexamined. Targets, files, destinations, and permissions can change between human prompts.
Controls need to assess those changes as the agent acts.
Approximately 2.4%
of sessions included dangerous actions beyond the user’s request.
An agent can have valid credentials and still perform work the user never requested, shifting execution beyond the task. Reviewing only the request and output can miss how that drift develops.
Agents can encounter credentials, customer records, and other sensitive information while completing everyday tasks. The security question is whether that access and any subsequent transfer is necessary for the work requested.
3.7%
of sessions handled sensitive information.
66.2%
of runtime policy findings involved privileged, destructive, or secret-reading actions without recorded approval.
Privileged operations, destructive commands, and secret retrieval can have consequences beyond the session. The findings highlight the need to verify whether required approval was obtained and whether controls
Ask yourself: can the organization identify the agent, understand its authority, and intervene before a consequential action exceeds the task? Apply that test across local agents, cloud platforms, native execution, and connected services.
Download the report to explore:
The report draws on aggregated Q1–Q3 2026 telemetry covering tool calls, file and connector activity, sensitive-data findings, skill loads, permissions, and human decisions. It also includes a separate review of 4,242 unique skills.
Coverage includes Claude Code, Cowork, Cursor, Kiro, OpenAI Codex, ChatGPT, GitHub Copilot, Microsoft Copilot Studio, AWS Bedrock, Antigravity, OpenClaw, and other platforms. Each brings different tools, permissions, and execution environments. The observed customer base spans fintech, media, cybersecurity, HR, hospitality, technology, and edtech. Fintech represents nearly 30%.
2026 SECURITY REPORT
