Melissa Ruzzi, director of AI at AppOmni said:
"True AGI (Artificial General Intelligence) may not be achieved before the next decade, but as GenAI evolves, it may be called AGI (which would then force the market to create a new acronym for the true AGI). The big risk in AGI is similar to GenAI, where the focus on functionality clouds proper cybersecurity due diligence. By trying to make AI as powerful as it can be, organizations may misconfigure settings, leading to overpermissions and data exposure. They may also grant too much power to one only AI, creating a major single point of failure.
"In 2026, we’ll see other AI security risks heighten even more, stemming from excessive permissions granted to AI and a lack of instructions provided to it about how to choose and use tools, potentially leading to data breaches. This will come from increased pressure from users expecting AI agents to become more powerful, and organizations under pressure to develop and release agents to production as fast as possible. And it will be especially true for AI agents running in SaaS environments, where sensitive data is likely already present and misconfigurations may already pose a risk."
And Brian Soby, CTO and co-founder of AppOmni added:
"We’re likely to see the perimeter continue to erode in 2026, through concepts such as zero trust network access (ZTNA), which begin at the user’s device and extend to their target destination, whether that’s within a virtual private cloud or a SaaS application. This transport layer of a Zero Trust architecture will likely become a common, if not dominant, method of securely connecting devices to destinations, making the traditional perimeter increasingly irrelevant.
"Most current zero trust and identity solutions are not keeping pace with real-world attacker tactics, techniques, and procedures (TTPs). As a result, in 2026, we’ll see more of what we’ve been seeing: Attacks adapting to target the weakest links. There’s no question the success of ShinyHunters/UNC6040 and Drift/UNC6395 has caught the attention of other threat groups. They will view those incidents as clear examples of the weaknesses in today’s zero trust technologies and will double down on similar attack methods."
