A hijacked AI agent looks exactly like a normal one, and 50% of security teams admit it

Every security leader knows the logic of anomaly detection. You learn what normal looks like, then you watch for departures from it. The approach has become so widely accepted that it barely draws debate anymore. But new research suggests that as enterprises hand real work to autonomous AI agents, the foundation that approach depends on is missing in a place where it matters most.

Abnormal AI’s 2026 State of Behavioral Security Report, released recently, finds that 46% of security professionals describe themselves as not at all effective at establishing what normal behavior looks like for AI agents. The finding sits awkwardly beside another number from the same survey: 43% of respondents say agents will receive their largest behavioral-monitoring investment over the next 24 months, more than three times the 14% who named API integrations. Organisations, in other words, are preparing to spend heavily on watching something they have not yet learned to describe.

Adoption was the easy part

Behavioral security differs from the signature-based tools that dominated the previous generation of defense. Rather than matching activity against a catalog of known threats, it uses AI to learn the typical patterns of each identity, account, and system, then flags what deviates. The model works well against attacks that have never been seen before, which is precisely why it has spread so quickly. More than 81% of the survey’s respondents now rely on behavioral anomaly detection to a major or extensive degree.

That maturity, however, appears to stop at the boundary of the human workforce. The harder problem, as Abnormal AI Field CISO Mick Leach puts it, is knowing what normal looks like for every employee, every service account, and every AI agent. “Adoption was the easy part,” Leach said, and the data bears him out. Deploying a detection platform is a procurement decision. Building an accurate, continuously updated picture of normal for thousands of identities is an operational discipline, and one that many organisations have not yet taken on for the non-human side of their environment.

Confidence that may be misplaced

The survey’s most striking contradiction concerns machine identities. Seventy-two percent of respondents say they are better prepared to detect anomalous behavior from non-human identities than from human ones. Yet 53% do not define normal behavior for machine identities at all.

Those two figures are difficult to reconcile. One plausible reading is that security teams assume machines are inherently more predictable than people: a service account runs the same job on the same schedule, so deviations should be obvious. That assumption held up reasonably well for traditional automation. It holds up far less well for AI agents, which make decisions, chain together tools, access data across systems, and can behave differently from one task to the next. An agent’s normal is not a fixed schedule. It is a range of acceptable behavior that has to be learned, and without that learning, a compromised or misbehaving agent can blend in with every other process running in the environment.

This is the core of the risk Leach describes. For human users, the question security teams ask is whether an action is unusual. For agents, the more useful question is whether it is unusual for this particular agent. A procurement agent that suddenly queries engineering repositories, or a customer-service agent that begins exporting records in bulk, may not trip a generic rule. Both would stand out sharply against an individual baseline. Teams unable to answer that second question, Leach argues, are missing the earliest warning sign available to them.

Detection is only half the battle

Even where anomalies are caught, the research points to a second weakness: what happens next. Ninety percent of respondents say understanding why an anomaly triggered is critical, which reflects a long-standing frustration with opaque alerts that analysts must reverse-engineer. But 51% report needing four hours or more to investigate and remediate a single anomaly.

For agents operating at machine speed, four hours is a long time. An autonomous system with broad access can touch a great deal of data, trigger downstream actions, and propagate errors or malicious instructions well before an analyst finishes triage. The gap between how quickly an agent can act and how slowly a team can respond is likely to become one of the defining operational challenges of agentic AI, and it suggests that explainability and response automation deserve as much attention as detection itself.

For technology leaders, the practical implication is that agent governance cannot be an afterthought bolted onto deployment. Before an agent goes into production, someone should be able to state what it is meant to access, what it is meant to do, and what its ordinary activity looks like. That definition becomes the baseline against which monitoring is meaningful. Without it, the sizable investment security teams are planning for agent monitoring risks producing a stream of alerts that nobody can confidently interpret.

It also argues for closer coordination between the teams building agents and the teams defending them. The people who design an agent understand its intended behavior better than anyone, and that knowledge rarely reaches the security operations center in a usable form. Closing that gap early is far cheaper than reconstructing intent after an incident.

Leach framed the broader lesson this way: the organisations that get ahead on AI agents will not be the ones with the most alerts, but the ones that know what normal looks like for every identity and can act the moment it changes. It is a useful standard, and a demanding one. Based on this research, most enterprises are still some distance from meeting it.