2026年AI威胁态势报告：AI智能体的崛起（英文版）

AITHREAT

LANDSCAPEREPORT

TABLEOFCONTENTS

04FOREWORD

05SECURITYFORAISURVEYINSIGHTSATAGLANCE

11AITHREATLANDSCAPETIMELINE

13WHAT’SNEWINAI

17PART1:RISKSPOSEDBYARTIFICIALINTELLIGENCE

17RiskstoSociety

20AI-PoweredCybercrime

26PART2:RISKSFACEDBYAI-BASEDSYSTEMS

26AttacksonModelFoundations

30AttacksAgainstGenAI

33AgenticSystemsSecurity

39AISupplyChainSecurity

47PART3:ADVANCEMENTSINSECURITYFORAI

47DefensiveFrameworksandInitiatives

51TheStateofAIRedTeaming

51NewGuidance&Legislation

57Part4:PredictionsandRecommendations

57Predictionsfor2026

60RecommendationsfortheSecurityPractitioner

61AboutHiddenLayer&Resources

2

3

4

FOREWORD

WeareenteringthenextphaseoftheAIrevolution.Whatbeganaspredictivemodelsandgenerativeinterfacesisrapidlyevolvingintoautonomous,agenticsystemscapableofplanning,reasoning,andactingonourbehalf.In2026,nomission,enterprise,orgovernmentagencywillremainuntouchedbyAIagentsoperatingacrossworkflows,networks,andcriticalinfrastructure.

AgenticAIrepresentsaprofoundleapforward.Thesesystemsarenolongerlimitedtorespondingtoprompts.Theycansetgoals,calltools,interactwithothersystems,generatecode,initiatetransactions,andadaptdynamicallytochangingenvironments.Properlyharnessed,theypromiseunprecedentedoperationalefficiency,acceleratedinnovation,andentirelynewmodelsofproductivity.Butautonomychangestheriskequation.

WhenAIsystemsareempoweredtotakeaction,theattacksurfaceexpandsdramatically.Thesamecapabilitiesthatenableagentstoautomatebusinessprocessescanbemanipulatedtoautomateexploitation.Thesamereasoningloopsthatdriveefficiencycanberedirectedtowardmaliciousobjectives.AsAIgainsagency,adversariesgainleverage.

Makenomistake,thedefiningAIsecuritychallengeofthiseraisnothypotheticalsuperintelligence.Itistheweaponization,manipulation,andcompromiseofautonomoussystemsbybadactors.

Agenticarchitecturesintroducenewlayersofvulnerability,includingtoolpoisoning,memorymanipulation,modelcontexthijacking,multi-agentcollusion,identityabuse,dataexfiltrationviaactionchains,andtheexploitationofdecision-makingloops.Theserisksarenottheoretical.Theyareemergingnowacrosscommercialenterprisesandfederalenvironments,experimentingwithAI-drivenautomation.

Traditionalcybersecurityprinciplesremainessential,buttheyarenolongersufficientontheirown.SecuringagenticAIdemandscontinuousvalidationofmodelbehavior,real-timeinspectionofagentactions,guardrailsaroundtoolaccess,andcontrolsthataccountforsystemscapableofindependentexecution.TheconvergenceofAIsecurityandapplicationsecurityhasneverbeenmoreurgent.

Inthisyear’sreport,weexaminehowtheriseofagenticAIisreshapingthethreatlandscape.WedetailthenovelattackpatternstargetingautonomoussystemsandanalyzehowadversariesareadaptingproventacticstoexploitAI-drivenworkflows.WesharefindingsfromsecurityandAIleadersdeployingagentsinproductionenvironments,alongwithdata-driveninsightsfromourworksecuringenterpriseAIsystems.Finally,wehighlightadvancementsinprotectivecontrolspurpose-builtforagenticarchitectures.

Asorganizationsracetowardautonomy,securitymustmovejustasquickly.Innovationwithoutprotectioninvitesdisruption.Autonomywithoutoversightinvitesabuse.

Letthisreportserveasaguidefornavigatingtheagenticeraresponsibly.Whetheryouarebuilding,deploying,ordefendingautonomoussystems,weinviteyoutojoinusinsecuringAInotjustasatool,butasanactorinourdigitalworld.

Weareproudtopresentthe2026HiddenLayerAIThreatLandscapeReport.

Tito

CEO&Co-Founder

(UnassistedbyLLMs)

SECURITYFORAISURVEYINSIGHTSATAGLANCE

erodescontrol,withmostorganizationsacknowledginguntrackeddeploymentsthatbypassgovernance,monitoring,andapprovalprocesses.Inagenticenvironments,delayeddetectionandunclearownershiparenotjustinefficiencies;theyenableautonomoussystemstopropagateharmfasterthantraditionalsecuritymodelsweredesignedtohandle.

Atthesametime,AIhasbecomefoundationaltobusinessoperations.Mostorganizationsnowconsiderbothinternallyoperatedandthird-partyAIsystemscriticaltorevenue,customerexperience,andoperationalresilience,yetconfidenceinvendorsecurityremainslimited.Takentogether,thefindingsreinforceacoreconclusionreflectedthroughoutthisreport:AIsystemsshouldbeassumedexploitable,notmerelyvulnerable.SecuringAIinanagenticerarequiresashiftawayfromone-timecontrolsandpolicyassertionstowardcontinuousaccountability,runtimemonitoring,enforceablegovernance,third-partyassurance,andsecuritymechanismsdesignedforsystemsthatevolveandactbeyondhuman-in-the-loopoversight.

Thisyear’ssurveyrevealsagrowingdisconnectbetweenhowAIsystemsarebeingdeployedandhowtheyarebeingsecured.OrganizationsarerapidlyoperationalizingAIwithincreasingautonomy,whilesecurityprogramsremainlargelyoptimizedforstaticmodelsandtraditionalapplicationcontrols.Foundationalsafeguardssuchasencryptionandsecuredeploymentarenowcommon,buttheoperationalcontrolsrequiredtomanageagenticbehavior,provideruntimevisibility,conductadversarialtesting,andimplementAI-specificincidentresponseremainunevenlyimplemented.AsAIsystemsgaintheabilitytoact,integrate,andmakedecisionsindependently,thesegapsarenolongertheoretical;theyarebecomingsourcesofsystemicenterpriserisk.

Thatriskisamplifiedbylimiteddetectionconfidenceandfragmentedaccountability.Nearlyone-thirdoforganizationscannotdefinitivelydeterminewhethertheyexperiencedanAIsecuritybreachinthepastyear,evenasattacksremainsteadyorincreaseandfrequentlyoriginatefrompublicmodels,chatbots,andagent-enabledsystems.ShadowAIfurther

AI’sCriticalRoleinBusinessSuccess

88%

78%

oforganizationsreportthatmostorallinternallyoperatedAImodelsarecriticaltobusinesssuccess.

reportthatembeddedthird-partyAImodelsarealsobusiness-critical,extendingriskbeyondinternaldeployments.

97%

92%

statethatAIprojectsarecriticalorimportanttorevenuegenerationoverthenext18months.

sayAIiscriticalorimportanttocustomerexperience,and96%tocorebusinessoperations,raisingtheimpactofAIsecurityfailures.

5

RisingAttacks—WithUnevenDetectionConfidence

69%

reportuncertainty,indicatingpersistentgapsinmonitoringanddetectionasAIsystemsgainautonomy.

sayattacksonAIsystemshaveincreasedorremainedthesamecomparedtothepreviousyear.

oforganizationsdefinitelyknowwhethertheyexperiencedanAIsecuritybreachinthepast12months.

AttackVectorsforAIBreaches

35%

Malwareinmodelspulledfrompublicrepositories

31%

14%

Third-partyapplications

13%

Attacksonagents

Inferenceattacksonpredictivemodels

6%

Attackoninternalorexternalchatbot

31%

71%

Sources&MotivationsofAIAttacks

TopSourcesofAIAttacks

◉Criminalhackinggroups—52%

◉Third-partyserviceproviders—45%

◉Freelancehackers—38%

◉Competitors—35%

◉State-sponsoredactors—31%

TopMotivationsforAIAttacks

◉Financialgain—50%

◉Sensitivedataexfiltration—48%

◉Businessdisruption—42%

◉Modeltheft—39%

◉Competitiveadvantage—27%

6

7

GLOBALORIGINSOFAIATTACKS

NorthAmerica58%Europe41%

Asia31%

SouthAmerica28%Africa20%

Unknown10%

41%58%

20%

31%

28%

Disclosure,Transparency,andRegulatoryPressure

53%

85%

ofleadersagreethatcompaniesshouldbelegallyrequiredtodiscloseAIsecuritybreaches.

However,53%reportthattheirorganizationhasoptednottodiscloseanAIincidentduetoreputationalconcerns.

TopThird-PartyGenAIApplicationsinUse

◉ChatGPT—77%

◉MicrosoftCopilot—68%

◉Gemini—57%

◉Claude—32%

◉Salesforce—27%

ChallengesinSecuringAgenticAI

◉76%reportthatshadowAI—unapprovedoruntrackedAIdeployments—isadefiniteorprobableproblem,butonly34%partnerexternallyfordetection.

◉93%useopen-weightmodelsfromrepositoriessuchasAWS,Azure,andHuggingFace,increasingexposuretosupplychainrisk,yetfewerthanhalfreportconsistentlyscanninginboundmodelsformaliciouscontentorintegrityissues.

TimeandResourcesDevotedtoAISecurity

◉Onaverage,professionalsreportspending46%oftheirtimeaddressingAIriskandsecurity.

◉91%haveaddedbudgetforAIsecurityin2025.

◉However,only58%allocate10%ormoreofAIspendingtoriskandsecuritymitigation,suggestingunderinvestmentrelativetodependency.

SECURITY

MEASURES&

GAPSINAGENTICAIDEFENSE

MostCommonAISecurityPractices

58%

BuildingrelationshipsbetweenAIandsecurityteams

54%

CreatinganinventoryofAImodels

50%

Determiningsourceoforiginformodels

32%

ScanningandauditingAImodels

32%

Extendingdetection&responsetoAIassets

29%

Only29%haveadedicatedAIincidentresponseplan.

19%

Only19%reportperformingmanualorautomatedAIredteaming.

Governance,Frameworks,andAccountability

haveimplementedanAIgovernancecommitteeorexecutivestructure.

reportclearlydefinedAI-relatedrolesbetweensecurityanddatascienceteams.

oforganizationsreportinternaldebateorconflictoverAIsecuritycontrol,highlightingtheneedforclearerteamalignments.

83%

68%

73%

TopFrameworksUsedtoGuideAISecurity

◉GartnerAITrust,Risk,andSecurityManagement—57%

◉GoogleSecureAIFramework—56%

◉IBMFrameworkforSecuringGenerativeAI—53%

◉NISTAIRiskManagementFramework—48%

◉DatabricksAISecurityFramework—41%

8

20252026

YEAR-OVER-YEAR

Exposure&Disclosure

Organizationsadmittingtheywithhelddisclosureduetobacklashconcerns

OrganizationsidentifyingshadowAIasaknownorprobablerisk

53%

45%

76%

61%

Visibility&Detection

OrganizationsdefinitivelyknowthattheyhaveexperiencedanAI-specificbreach

Organizationsreportingtheyprobablydon’tknow,don’tknow,orhavenowaytoknowifanAIbreachoccurred

67%

74%

33%26%

OrganizationalDynamics

OrganizationsreportinginternaldebateorconflictoverAIsecurityinitiatives

73%

76%

AICriticality

AIprojectsratedcriticalorimportanttorevenuegenerationOrganizationssayingallormostoperatedAImodelsarecritical

tobusinesssuccess

88%

96%

97%89%

SurveyHighlights

◉1in8AIbreachesarearesultofAIagents

◉Over1/3rdofAIbreachesarearesultofAIchatbots

◉GovernanceExists-ButIt’sChaotic

•83%havegovernancecommittees,73%reportconflict,andonly68%haveroleclarity

◉Open-weightmodelsarethetopsourceofAIbreaches

•Malwareinpublicrepositoriesaccountsfor35%

ofbreaches,yet93%oforganizationsstillusethem

9

AITHREATLANDSCAPEINANUTSHELL

RisksrelatedtotheuseofAI

EvolutionofrisksfacedbyAI-basedSystems

Poisoningattacks

Inferenceattacks(Modelevasion&theft)

AIsupplychainattacks(Modelhijacking:serializationvulnerabilities&graphbackdoors)

GenAIpromptattacks(Guardrailbypass,indirectpromptinjection,promptobfuscation)

Attacksagainstagenticsystems

10

AITHREATLANDSCAPETIMELINE2025

AIMilestones,RisksPosedbyAI,RisksFacedbyAI,SecurityInitiatives

JAN

◉AnoveluniversalbypassforallmajorLLMsunveiledbyHiddenLayer

◉OpenAIlaunchesOperator-oneofthefirstAIagents

◉ServiceNowlaunchesAIAgents&Orchestrator

◉Googleagreestoinvest$1billionintoAnthropic

◉AstudypublishedinNatureMedicinerevealsmedicalLLMshighlypronetopoisoning

◉ModelgenealogytechniquecalledShadowGenespublishedbyHiddenLayer

◉InvariantLabsdiscoversMCPvulnerabilitythatallowsfortoolpoisoningattacks

◉SpiderLabspublishesAgentIntheMiddle-atechniqueofabusingA2Aprotocol

◉ModelSigningProjectv1.0releasedbyOpenSSFAI/

MLWorkingGroup

o-MAY

FEB

◉AnthropiclaunchesClaude4andmakesClaudeCodegenerallyavailable

◉MSannouncesnativesupportforMCPonWindows11

◉DockercreatesMCPcatalogue

◉HiddenLayer’sresearchersdemonstrateparameterabuseinMCPservers

◉MITREproposesadefender-focusedframeworkSAFE-AI

◉ThefirstAISBOMgeneratortoolunveiledatRSA2025conference

◉AnthropiclaunchesClaude3.7Thinking

◉OpenAIlaunchesGPT-4.5andDeepResearch

◉Storm-1516disinformationoperationtargetselectionsinGermany

◉BasiliskVenomattackshowshowhiddenpromptscancreatebackdoorsinmodels

◉OWASPstartstheirAgenticSecurityInitiative

◉CloudSecurityAlliancereleasesAgenticAIThreatModelingFrameworkMAESTRO

JUN

◉SalesforcereleasesAgentforce3.0

◉ResearchersatCyLabdemonstratedatapoisoningattackswith0.1%ofpoisoneddataset

◉CVPR2025paperstakebackdoorandevasionattacksonmodelstothenextlevel

◉HiddenLayerdemonstratesTokenBreak-amethodtobypassguardrailmodels

◉Asanadisclosesamajorcross-tenantbreachcausedbyabugintheirMCPserver

◉BackslashSecurity’sresearchfindshundredsofmisconfiguredMCPservers

◉HiddenLayerpublishestheAPEtaxonomyforclassificationofpromptattacks

o-MAR

◉OpenAIadoptsMCPacrossitsproducts

◉MicrosoftintegratesagentsintoCopilotStudio

◉GooglereleasesGemini2.5Pro-thinkingmodelwithadvancedreasoning

o-APR

◉

MicrosoftintroducesAgentFlows-AnAIworkflowautomationinCopilotStudio

◉

◉

GooglelaunchesMCPToolboxforDatabases

GoogleintroducesAgent2Agentprotocolforinter-agentcommunication

◉

TeenagerdiesafterconfidingsuicidalthoughtstoChatGPT

◉

Paper“MachineUnlearningFailstoRemoveDataPoisoning”publishedatICLR2025

◉

Researchersprovesimpleinterferencecanfooltrafficsignrecognitioninself-drivingcars

11

Moldova’selection

JUL

◉HiddenLayerunveilspracticalcodeassistantAIviruses

◉KoidiscoversthefirstmaliciousMCPserverinthewild

◉AWSintroducesKiroAI-anagenticIDE

OCT

◉CognitionacquiresWindsurfAIIDE

◉OpenAIlaunchesChatGPTAtlasagenticbrowser

◉AmazonBedrockAgentCorebecomesgenerallyavailable

◉Researchersprovethatevenaslittleas250maliciousdocumentscanpoisonLLMs

◉TheVirusInfectionAttack(VIA)isintroducedatNeurIPS2025

◉DeserializationvulnerabilityinKeras(CVE-2025-49655)isdisclosedbyHiddenLayer

◉CoSAIpublishesAIIncidentResponseFrameworkv1.0

◉MicrosoftcreatesDataverseMCPServer

◉MicrosoftintroducesEdgeCopilot-anAImodefortheEdgebrowser.

◉PerplexityAIintroducesComet-abrowserwithanintegratedAIassistant

◉MandiesbysuicideafterreceivingencouragingmessagesfromChatGPT

◉Vinciworksreportsover50casesinvolvingfakelegalcitationsgeneratedbyAI

◉CERT-UAdiscoversLAMEHUG,aninfostealerthatreliesonLLM

NOV

◉HiddenLayerdemonstrateshiddenpromptinjectionsthatcanhijackAIcodeassistants

◉AnthropicreleasesClaudeOpus4.5

◉GooglelaunchesAntigravity-anagent-firstIDE

◉ReleaseofClawdbot(nowOpenClaw)-afree,open-sourcepersonalAIassistant

◉AnthropicunveilsthefirstAI-driven,large-scalecyberespionagecampaign

◉GoogledetailsseveralstrainsofnovelAI-poweredmalware

◉UKconsumerswarnedoverAIchatbotsgivinginaccuratefinancialadvice

◉HiddenLayerpublishesEchoGram-avulnerabilityunderminingAIguardrails

◉CriticalRCEVulnerabilityfoundinmcp-remotepackage

◉CoalitionforSecureAIpublishesPrinciplesforSecure-by-DesignAgenticSystems

AUG

◉OpenAIreleasesGPT-5

◉ManhospitalizedaftertrustingChatGPTadvice

◉ManmurdershismotherandkillshimselfafterChatGPTfuelshisparanoiddelusions

◉Anthropicreleasesreportdetailingthefirstfullyautomatedcybercrimecampaign

DEC,2025-EARLYJAN,2026

◉Anthropic’sReporthighlightstheuseofAIinromancescamsandremoteworkerfraud

◉GoogleGemini3DeepThink

◉MistralAIlaunchedtheMistral3family

◉OpenAIreleasesGPT-5.2

◉GoogleaddsMCPsupportforGoogleservices

◉WIREDenquiryuncoversoneofthefirstinstancesofdeepfake-as-a-service

◉SexualizeddeepfakecontentgeneratedwithGrokfloodsxAI

◉TheChameleon’sTrapcampaignusesphishingemailswithhiddenpromptinjections

◉HiddenLayerresearchersportShadowLogicbackdoorintoagenticsettings

◉CheckmarxrevealmodelconfusionattacksonHuggingFace

◉OWASPformallylaunchestheirAIBOMProject

◉OWASPreleasesTop10forAgenticApplications

◉NISTreleasespreliminarydraftoftheirCyberAIProfile

◉ThefirstknownAI-poweredransomware,PromptLock,isdiscoveredbyESET

◉HiddenLayerunveilsVISOR-atechniqueofmodifyingmodelbehaviorusingimages

◉HiddenLayerdemonstratespersistentlogicalbackdoors

◉MajorsupplychainbreachthroughSalesloft’sDriftAIchatbotimpactshundredsofbusinesses

◉S1ngularitybecomesthefirstknownsupplychainattackthatscansforandleverageslocallyaccessibleLLMs

SEP

◉AnthropiclaunchesClaude4.5Sonnet&Opus

◉OperalaunchesNeonagenticbrowser

◉GoogleintroducesAgentPaymentProtocol

◉Nvidiaintendstoinvest$100billionintoOpenAI

◉ASML&MistralAIenterstrategicpartnership

◉Disinformationcampaignspreadsdeepfakestargeting

12

13

WHAT’SNEWINAI

Ayearhaspassedsinceour

previousAIThreatReport

,andthelandscapeofgenerativeAIhasshiftedsignificantly,withthepaceofimprovementsthrough2025matching,andinsomecasesexceeding,thatofthepreviousyear.Amongthesedevelopments,themostsignificantincludetheevolutionofdeepreasoningmodels,alongsidesmaller,highlyspecializedEdgeAImodels,andtherapidpopularizationofagenticAIsystems.

2025InflectionPoints

GenerativeAImodelshavecontinuedtogrowinscale,capability,andversatility,andoverthepast12months,haveintroducednewcapabilitiessuchasreasoningandself-improvement.Thesecapabilitieshavebecomecentraltohowmodernfoundationmodelsoperate.

DeepSeekR1&OpenAIO1

GPT-5.2,Gemini3,Opus4.6

EarlyReasoningModels

EmergentReasoningStructuredInference

NextGenerationModels

ExtendedReasoning

Multi-DomainProblem-Solving

WhatbeganwithearlyreasoningmodelssuchasDeepSeekandOpenAI’sO1hassinceledtomoreadvancedfoundationmodelslikeOpenAI’s

GPT-5.2

,Google’s

GeminiDeepThink,

andClaude

Opus4.6

thatexplicitlyallocateinferencetimetoreasonthroughcomplexproblemsbeforeproducingananswer.ThiscapacityforpausingandreflectionaffectshowLLMshandle

mathematicalproofs,

scientificquestions,andsituationswherenuancematters.

Inadditiontobuildinglargergeneral-purposemodels,thereisalsoatrendofimprovingsmall,specializedmodelsdesignedfordeploymentinsmartphones,autonomousvehicles,IoTsensors,andotherembeddedsystems.Theseso-called

tinymodels

,compactenoughtorunentirelyon-device,havebecomeincreasinglydesirableasorganizationsshiftfromcentralizedcloudinfrastructuretowardlocal,oredge-based,deployment.

While

edgeAI

maylackthebreadthandflexibilityofcloud-basedsystems,itbenefitsfromdeepspecializationtailoredtothespecificdomainsinwhichitisdeployed,includinghealthcare,finance,defense,andtransportation.Theyalsoofferbenefitsthatarecriticalinmanyenvironments,particularlyincriticalinfrastructure,includingimprovedprivacy,low-latencyresponses,andofflineoperation.

14

HDDNAYE

TheconversationaroundautonomousAIagentsgainedmomentumin2024,butitwasn’tuntil2025thatthingstrulybegantotakeshape.Theshiftfromexperimentaldemonstrationstoproduction-gradesystemsoccurredrapidly,asmajorvendorsexpandedAIcapabilitiesbeyondquestionansweringintoautonomoustaskexecution.

AIagentsvarywidelyinformandfunction,withapplicationsspanningabroadrangeofusecases.Forthepurposeof

simplicity,twoprimarycategoriesofAIagentsemergedin2025:general-purposeagents,whicharemultifunctional,desktop-integratedassistants,andapplication-specificagents,designedtooperatewithinnarrowlydefinedsoftwareenvironments.

Belowareafewhigh-profilepioneeringexamples,asseveralbusinessesacrosssectorsfollowedwiththereleaseoftheirownsolutions.

Type

Developer

Name

Description

InitialReleaseDate

Multipurposeuserassistant

Google

Project

Mariner

AnexperimentalChromeextensioncapableofbrowsingwebsitesandreasoningacrossbrowsercontent.

Prototypeintroducedinlate2024

Multipurposeuserassistant

OpenAI

Operator

OneofthefirstAIagentsbuilttonavigatewebsitesandcompletetasksonbehalfofusers.NowfullyintegratedintotheChatGPT

agent.

January2025

Multipurposeuserassistant

OpenAI

Deep

Research

Modelfocusedoninformationretrievalanddataanalysis,capableofperformingmulti-stepresearchformorecomplextasks.NowunifiedintoaChatGPTagent.

February2025

Multipurposeuserassistant

Google

Gemini2.5

Introducedagenticandreasoningcapabilities.

March2025

Multipurposeuserassistant

Anthropic

Claude4

Sonnet&

Opus

Modelswithagenticcapabilitiesandextendedthinking.

March2025

Multipurposeuserassistant

Anthropic

Claude4.5

Sonnet

Furtherevolutionofreasoningandagenticfeatures.

September2025

Multipurposeuserassistant

Anthropic

Claude4.5

Opus

Furtherevolutionofreasoningandagenticfeatures.

November2025

Multipurposeuserassistant

Google

Gemini3&

Gemini3

DeepThink

Improvedagenticandreasoningcapabilities.

December2025

Agenticbrowser

Microsoft

EdgeCopilot

AImodeforEdgebrowser.

July2025

Agenticbrowser

PerplexityAI

Comet

AbrowserwithanintegratedAIassistantandPerplexity’sAIsearchengine.

March2025

Agenticbrowser

OpenAI

ChatGPT

Atlas

Abrowserwithabuilt-inChatGPTagent.

October2025

Agenticbrowser

Opera

Neon

Abrowserwithagenticcapabilities.

December2025

Codingassistant

Cognition

Windsurf

AgenticIDE.

November2024;

acquiredbyCognitioninJuly2025

Codingassistant

Anthropic

ClaudeCode

Terminal-firstAIcodingassistantthatdeeplyunderstandsfullcodebasesusingagenticsearchtoscanandinterpretentireprojectswithoutmanualfileselection.

February2025

HDDNlAYER

Type

Developer

Name

Description

InitialReleaseDate

Codingassistant

OpenAI

Codexagent

Cloud-basedsoftwareengineeringagent.

May2025

Codingassistant

AWS

Kiro

AgenticIDE.

July2025(preview),November2025(GA)

Codingassistant

Google

Antigravity

EnablesdeveloperstodelegatecomplexcodingtaskstoautonomousAIagents.

November2025

AIautomationframework

n8nGmbH

n8n

AnAIworkflowautomationframeworkthatevolvedintoanagenticsolution.

Late2024-early2025

AIagentplatform

ServiceNow

AIAgent

Orchestrator

AcentralmanagementsystemforAIagentsspecializedinITservicemanagement,HR,CRM,andriskmanagement.

January2025

AIautomationframework

Microsoft

AgentFlows

AnAIworkflowautomationfeaturebuiltintoMicrosoftCopilotStudio.

April2025

AIagentplatform

Salesforce

Agentforce

3.0

AsuiteofnativeAIagentsdesignedtosupportawiderangeofbusinessoperations.

June2025

AIagentplatform

Amazon

Bedrock

AgentCore

Aplatformforbuilding,deploying,andscalingAIagents.

July2025(preview);October2025(GA)

ProtocolsStandardization

Thespeedatwhichagenticapplicationsevolvedisverynotable.Behindthescenes,though,infrastructurehasemergedasthedefiningfactor.Foragentstoworkacrossdifferentsystemsandservices,everyoneneedstospeakthesamelanguage,and2025sawanexplosionofprotocolsandtoolingthatmadethispossible.The

ModelContextProtocol

(MCP),introducedbyAnthropicinlate2024,gainedsignificanttractionasastandardizedmechanismforconnectingAIagentstoexternaldatasourcesandtools.Google’s

Agent-to-Agent

(A2A)protocolemergedinApril2025asthefirststandardforinter-agentcommunication.Afewmonthslater,Googlereleasedthe

Agent

PaymentProtocol

(AP2),aimedatenablingsecure,agent-initiatedpayments.Numerouscompaniesrushedtoreleasetheirownagenticframeworksduringthisperiod,includingOpenAI’sAgentKit,StrandsAgentsSDK,andAmazon’sBedrockAgentCore.It’sbecomeclearthatagenticAIdependsnotonlyonmodelcapabilitybutonabroaderecosystemofsupportinginfrastructure.

Majortechnologyprovidershavemovedquicklytosupporttheseprotocols,reflectingtheirstrategicimportanceforfutureAIplatforms.Googlereleasedthe

MCPToolboxfordatabases

andannounced

MCPsupportforGoogleServices

.OpenAIadded

remoteMCPsupport

andwrappedsomeoftheirexistingtoolstoworkwithintheprotocol.Microsoftbuilt

MCPsupport

directlyintoWindows

andcreateda

DataverseMCPserver

.Chromegot

DevToolsMCPintegration

.Thiswasfollowedbyrapidadoptionacrosstheecosystem,withAWS,GitHub,Salesforce,Asana,Cloudflare,PayPal,Stripe,anddozensofothersdeployingtheirownMCPservers.Dockerevencreatedanentire

MCPcatalog

tohelpdevelopersfindanddeploythem.

Withinmonths,whatstartedasanichetechnicalspecificationbecamethestandardwaythatAIagentsconnectedtotherestofthedigitalworld.Today,MCPboasts

100milliondownloads

eachmonth

.Unfortunately,aseverybodyrushestodeployagenticsolutions,thesecurityofthesesystemslagsbehind,creatingavastnewattackvector.

15

HDDNAYE

MajorInvestments&Partnerships

InvestmentinAIduring2025reachedlevelsthatwouldhaveseemedimplausibleonlyafewyearsearlier,withdealsthatreshapedthecompetitivelandscapealmostovernight.

Atthebeginningof2025,techgiantspledged$500billiontothe

USStargateProject

,and

Googleagreedtoinvest$1billion

intoAnthropic

,continuingitsstrategyofbackingmultiplehorsesintheracewhilehedgingagainstbeingleftbehind.InSeptember,

Nvidia’scommitmentto