By 2026, AI agents are no longer a fringe phenomenon in professional workflows. They read documents, access systems and take steps on their own. At the same time, the signals are piling up that this autonomy leads above all to problems around sensitive data. Several recent reports point in the same direction: agents touch information that organisations have no oversight of, and this leads to leaks and compliance risks.
According to Kiteworks (AI Agent Security Incidents Hit 65% of Firms in 2026), 65% of the organisations surveyed had at least one AI agent incident, with 61% of those incidents involving the exposure of sensitive data. GetAIGovernance reports, based on the AvePoint State of AI survey, that 88.4% of organisations running AI agents had at least one AI-agent-related breach in the preceding twelve months, with data leakage and prompt manipulation as the most common incident types. The common thread is clear: agent incidents overwhelmingly concern data that should not have leaked out.
The core problem: organisations do not know what agents touch
The underlying cause is a lack of visibility. In the analysis by NHIMG (How should security teams govern data access for agentic AI workflows?), 80% of organisations report that AI agents have already acted outside their intended scope, including the inappropriate sharing of sensitive data and the disclosure of access credentials. Only 52% can monitor which data agents access. In other words: almost half do not know which agent consulted which information.
That picture aligns with the governance analysis by Zylos.ai (AI Agent Governance and Compliance in 2026), which states that 82% of companies are dealing with unknown agents or workflows within their own environment. Without an inventory and without access control, precisely the kind of blind spot arises in which sensitive data can slip out unnoticed.
The weekly report by AIAgentStore (Data Privacy & Security Agentic AI News) shows that this does not remain a matter of abstract risks. It describes concrete vulnerabilities in agent frameworks, including CVE-2026-42271 in LiteLLM and CVE-2026-47392 in PraisonAI. In response, mitigations such as lockdown modes and opt-in governance controls are appearing. The message: agent frameworks and their integrations can be misused for data exfiltration and the compromise of hosts, and responsible deployment demands tight control.
Regulators are extending the line to agents
Regulation is keeping pace. Zylos.ai describes how the enforcement of the EU AI Act coincides with rules at federal and state level in the United States, including the California AI Act. The expectations are becoming concrete: audit trails, accountability frameworks, logging of access to protected health data under HIPAA, and breach notification obligations. Existing privacy and compliance requirements are thereby being explicitly extended to AI agents and the workflows in which they operate.
For professionals who work with confidential information, this means that an AI agent can no longer be seen as an opaque automation instrument. It is a data player that falls under governance: with limited rights, enforceable policy and demonstrable logging.
What professionals must now require of AI agents
From the combined developments, several concrete data governance requirements can be distilled:
- Least-privilege data access: an agent is given access only to the data needed for the task, no more.
- Central policy enforcement: access rules are enforced in one place rather than per individual integration.
- Granular logging: recording which agent consulted which data and which actions were carried out, so that reconstruction is possible after the fact.
- Independent verification: making it verifiable what an agent has consulted and generated, so that the result is not taken on good faith.
These requirements are not a luxury. They follow directly from the finding that most organisations already cannot demonstrate what their agents do with sensitive data, while regulators are going to ask for precisely that demonstrability.
Where a verification layer can help
The signals from this research touch directly on the way in which I am Vera has been designed. Vera is not a chatbot and not a language model of its own, but a privacy-focused verification layer for professionals who work with confidential information.
Part of the risks identified lie in what is unintentionally sent to AI models. The Semantic Privacy Shield carries out preprocessing and anonymisation on EU infrastructure, with the workflow designed to send only anonymised content to the selected AI models. If a privacy check fails, nothing is forwarded. This can help prevent sensitive source data from ending up unnoticed at external models.
A second part of the risks lies in blind trust in agent output. Vera makes checking possible by making verification steps visible and testing answers across multiple models. This does not eliminate errors, but it provides more insight into what has been consulted and generated. Documents can be viewed and edited within the same secure environment via Vera Office, so that sensitive content is not needlessly spread around.
The developments of 2026 show that the time when AI agents could operate as invisible helpers is over. Anyone working with confidential information will have to restrict data access, log actions and verify output. The professional final judgement always remains with the user; verifiability only makes that judgement better substantiated.