How to defend an exploding AI attack surface when the attackers haven't shown up (yet) (opens in new tab)

The dilemma in AI agent security in 2026 is that organizational attack surface is expanding at comic pace but, at least as of January, the attackers haven’t yet shown up (at least at the level of serious attackers achieving serious objectives a la ransomware or nation state level compromise of a network via AI native risk vectors like prompt injection), which means we lack empirical signals to tune / train defenses, and help prioritize where leaders should pay the price in friction and ...