10 AI agent incidents in 49 days. Your governance program just became a liability.

The Cloud Security Alliance just published a report that should make every CISO lose sleep.

10 verified AI agent security incidents in 49 days.

Prompt injection into developer tools. Malicious skills poisoning in agent plugin ecosystems. Shadow traffic between agents that evaded every monitoring system in place.

Three structural failures showed up in every single case.

No binding between agent actions and verified non-human identities. Your agents are operating under shared service accounts with no lifecycle management.

Audit logs that could be altered or were never generated for agent-to-agent traffic. Your compliance team cannot reconstruct what happened in a breach.

No mechanism to detect shadow traffic between agents operating outside sanctioned communication paths. Your agents are talking to each other and you have zero visibility.

This is not theoretical. The EU Cyber Resilience Act is enforceable. The Bank of England is signaling bespoke agentic AI requirements. EU AI Act enforcement infrastructure is operational with 38 dedicated staff.

If your agent governance program was designed for static AI models, it is structurally insufficient for agentic deployments.

Audit every production agent deployment today. Confirm each operates under a registered non-human identity with a documented lifecycle. Test your audit logging against agent-to-agent traffic specifically. Add shadow traffic detection to your monitoring. Map each of the ten CSA incident types to your incident response playbook.

The benchmark regulators will use to judge your governance program just went public.

SOURCE: https://aigovernance.com/news/ten-ai-agent-incidents-in-49-days-csa-finds-identity-and-logging-controls-missing
VERIFIED: Cloud Security Alliance (primary report), AI Governance Institute, BleepingComputer
SIGNAL: 10 incidents in 49 days establishes an empirical frequency baseline that regulators, auditors, and insurers will use to assess whether an enterprise's agent governance program is adequate.