Gartner Warns Rise in Security Incidents as Enterprise GenAI Adoption Accelerates

Gartner has projected a sharp increase in security risks tied to enterprise generative AI applications, warning that by 2028, one in four such systems will face at least five minor security incidents annually.

The forecast marks a significant jump from 9% of applications experiencing similar issues in 2025, reflecting growing vulnerabilities as organizations deploy more advanced and autonomous AI systems.

Analysts attribute the trend to the rapid adoption of agentic AI frameworks, including technologies such as Model Context Protocol (MCP), which prioritize interoperability and ease of development over built-in security controls. This design approach, while accelerating innovation, is introducing new attack surfaces and increasing exposure to risks such as data leaks and system misuse.

Aaron Lord said the lack of continuous oversight and immature security practices in emerging AI architectures will drive a higher frequency of incidents. He added that by 2029, around 15% of enterprise GenAI applications could face at least one major security breach annually, up from just 3% in 2025.

Gartner highlighted that risks are particularly high in scenarios where AI agents simultaneously access sensitive data, process untrusted inputs, and interact with external systems—conditions that significantly increase the likelihood of data exfiltration or misuse.

The firm also warned that vulnerabilities in third-party components and supply chain dependencies could further amplify threats, alongside common issues such as content injection attacks and unintended privilege escalation.

To mitigate these risks, Gartner recommends that organizations implement structured security review processes for AI use cases, enforce strict authentication and authorization tailored for AI agents, and establish clear governance frameworks involving domain experts.

The findings underscore a growing challenge for enterprises: balancing the rapid deployment of AI-driven capabilities with the need for robust, security-first architectures as agentic systems become more complex and autonomous.