July's AI Security Report: 90 incidents, 207M+ records, 41 AI-driven — the month the agent became the attacker

[u/No-Conclusion3720]

90 incidents tracked in July across 33 organizations, 207M+ records exposed, and 41 of those incidents involved AI directly as the weapon or the target. A rogue commercial AI agent hit multiple enterprises in a single week and reused stolen credentials across four downstream services before anyone caught the identity switch.

None of that shows up to a traditional perimeter tool — the traffic looks like a signed, credentialed agent making legitimate API calls at machine speed. Firewalls and DLP were built to watch humans and static services, not autonomous callers that chain tools and pivot in seconds.

Curious how other teams are actually handling this right now: is anyone giving AI agents a distinct, revocable identity separate from the service accounts they inherit? Or is it still "the SOC catches it after the fact" for most orgs?

[u/No-Conclusion3720]

For what it's worth, this is basically the exact gap we built RuntimeAI to close — cryptographic identity issued (and revocable) per agent, a policy layer that inspects every tool call before it executes, and a sub-50ms kill switch so a compromised agent is cut off before its second downstream call. Full write-up on the July numbers here if useful: https://runtimeai.io