New research from the Netskope AI Report: 2026 has found that downstream data policy violations are now the second most common form of enterprise AI violation, accounting for 924 of every 10,000 alerts, or almost one in ten. Only upstream data policy violations occur more frequently.
Downstream violations happen when an AI service returns information that a user or agent is not authorised to access. Their frequency has more than doubled over the past year, rising from an average of 12 to 31 violations per organisation each week. Among the top 25% of organisations, the increase has been even sharper, from 72 to 206 violations per week.
This increase is being driven by the rapid adoption of the Model Context Protocol (MCP), an open standard that allows AI models and agents to connect to external data sources and tools. Over a ten-week period, the number of users accessing remote MCP servers increased by 250%, while MCP transactions rose by 375%. This is allowing AI systems to access more enterprise data, but also creating new opportunities for sensitive information to be returned to the wrong person or agent.
Upstream data policy violations, where users or agents send sensitive information to an AI application, remain the most common risk, accounting for 8,752 of every 10,000 AI alerts. However, the report shows that the range of enterprise AI threats is widening. After downstream violations, organisations are also detecting content filtering violations (154), prompt injection and jailbreaking attempts (129) and deliberate requests for sensitive information (28). Malicious code remains the lowest-volume category, at five alerts per 10,000, but carries critical severity because it may be executed directly by an autonomous agent or incorporated into a wider codebase.
The research also suggests that shadow AI is unlikely to disappear. At present, 30% of enterprise AI users access only personal AI applications, while a further 14% use both personal and organisation-managed tools. Although shadow AI usage declined as organisations introduced managed AI tools, that trend plateaued around March 2026 and has since begun to reverse slightly. This suggests organisations are increasingly putting guardrails around the use of personal AI applications rather than attempting to move every user and use case onto a managed platform.
“The 2026 threat landscape has moved beyond shadow AI discovery into a phase of bidirectional, agentic risk,” said Ray Canzanese, Director of Netskope Threat Labs. “We are no longer just monitoring the prompts employees send to third-party models; we are now governing the integrity of the AI supply chain. The rapid integration of the Model Context Protocol (MCP) effectively bridges our internal data stores with external agents, while the surge in autonomous coding tools like Cursor and Claude Code has drastically lowered the barrier for automated, malicious code execution. For security teams, this mandates a pivot from simple data to bidirectional inspection. We need to treat every agentic interaction as a potential execution vector, not just a data request”.
Additional key findings include:
Average AI prompt volumes tripled over the past year, rising from 1,498 to 4,731 prompts per organisation per week. The top 25% of organisations generate at least 19,292 prompts each week.
Adoption of AI coding applications rose from 42% to 84% of organisations over the past year. Claude Code is now used by 75% of organisations and Codex by 58%, despite both recording adoption rates below 1% a year earlier.
41% of organisations are now using Ollama to run AI models locally, as businesses look to keep greater control over where data is processed and reduce reliance on cloud-based platforms.
Enterprise users accessing AI applications each week increased from 34% to 59%. Among the top 25% of organisations, at least 77% of employees now use AI each week.
Regulated data and source code each accounted for 35% of upstream violations, followed by intellectual property at 20% and passwords and keys at 10%.
The number of users encountering malicious AI lures increased sharply from March 2026, with recent campaigns including fake AI application installers, phishing pages and trojanised developer tools.