1/ 78% of CISOs have already had to pull permissions from an AI agent running in production. Only 18% check an agent’s identity before it acts.
A survey of 300 security chiefs out today shows how far agent identity security has fallen behind agent adoption, and who is building the fix. 🧵 below.
AI is transforming cyber defense.
Since June, OpenAI's models and Trail of Bits engineers have found 1,995 security bugs across 68 open-source projects.
This has resulted in:
- Engineers writing patches for 679 (34%)
- Project maintainers implementing 466 (23%)
For scale, this is one small program: Anthropic says its Glasswing partners verified 129,000 vulnerabilities in four months (April to July 2026).
Finding bugs is no longer the hard part. Writing the fix and getting it implemented is.
That work is done by a security firm and the projects' maintainers. AI will enhance those processes as well.
Institutions are 💎 hands: Not one institution we interviewed reduced its allocation through the roughly 50% drawdown between Q4 2025 and Q2 2026. Several bought more.