Downstream data policy violations have more than doubled in the past year, reaching an average of 31 incidents per organisation each week, according to the Netskope AI Report 2026 full findings. These cases occur when an AI service returns information a user or agent is not authorised to see. They now make up 924 of every 10,000 AI alerts, second only to the still-dominant upstream leaks.
The jump tracks a sharp rise in Model Context Protocol traffic that lets agents reach internal data stores. Security teams that spent two years watching what employees pasted into prompts now face data flowing the other way.
The Weekly Numbers Behind the Doubling
Average organisations saw downstream violations climb from 12 to 31 per week. Among the top 25 percent of organisations the rise was steeper, from 72 to 206. Upstream violations remain far more common at 8,752 of every 10,000 alerts, yet the share of other categories is climbing.
| Violation type | Alerts per 10,000 | Trend note |
|---|---|---|
| Upstream data policy | 8,752 | Still largest share |
| Downstream data policy | 924 | More than doubled year-over-year |
| Content filtering | 154 | Bidirectional policy hits |
| Prompt injection / jailbreak | 129 | Critical severity |
| Deliberate sensitive requests | 28 | Higher intent signal |
| Malicious code | 5 | Lowest volume, highest severity |
Prompt volume itself tripled, from 1,498 to 4,731 per organisation per week. The top quartile now generates at least 19,292 prompts weekly. Enterprise users interacting with AI each week rose from 34 percent to 59 percent; in the top 25 percent of firms that figure hits 77 percent or more.
- Regulated data and source code each make up 35 percent of upstream violations.
- Intellectual property accounts for 20 percent.
- Passwords and keys contribute 10 percent, often buried inside code or config files.
These figures come from Netskope’s anonymised customer telemetry covering June 2025 through July 2026.
How MCP Turned Connections Into a Two-Way Risk
The Model Context Protocol is the open standard that lets AI models and agents talk to external tools and data sources. Anthropic open-sourced the Model Context Protocol in November 2024 so developers could replace one-off integrations with a single, reusable bridge. Servers expose repositories, databases, ticketing systems or code bases; clients (the agents) call them.
Over a recent ten-week window, users accessing remote MCP servers rose 250 percent and MCP transactions jumped 375 percent. Coding agents such as Claude Code and Codex rank among the heaviest clients. The protocol works as designed: it shortens the path from internal store to model context. That same path now carries sensitive records back to whoever (or whatever) issued the request.
Downstream violations arise when the returned payload contains data the requesting user or agent lacks permission to hold. The problem is architectural, not merely careless pasting. Once an agent can query a live system, the old assumption that risk lives only in the prompt collapses.
Coding Agents Drove Adoption and New Execution Paths
AI coding applications moved from 42 percent to 84 percent of organisations in a year. Claude Code now runs at 75 percent of organisations and Codex at 58 percent; both sat below 1 percent twelve months earlier. GitHub Copilot and Cursor, the earlier leaders built as IDE assistants, have largely plateaued while the fully agentic tools keep climbing.
| Tool / category | Current org adoption | Year-ago baseline |
|---|---|---|
| AI coding apps overall | 84% | 42% |
| Claude Code | 75% | <1% |
| Codex | 58% | <1% |
| Ollama (local models) | 41% | rising |
Agentic tools generate and often execute code far faster than humans. That speed multiplies both legitimate output and the chance that malicious snippets, whether injected or hallucinated, reach production or run directly. Malicious-code alerts remain rare at five per 10,000, yet their severity is critical precisely because an autonomous agent can act on them without a human pause.
Local runtimes such as Ollama, used by 41 percent of organisations, reflect the parallel push for data sovereignty. Firms want to keep models and data inside their own perimeter, sometimes pairing them with local open models such as Gemma. The same local stacks still need MCP-style connectors if agents are to do useful work, so the downstream path reappears inside the network.
Shadow AI Stopped Shrinking and Settled In
For years the security narrative treated shadow AI as a temporary phase that managed platforms would eventually absorb. That absorption slowed and then reversed slightly after March 2026. Today 30 percent of enterprise AI users touch only personal applications, 14 percent use both personal and managed tools, and 56 percent stay on managed apps alone.
Organisations appear to have accepted a dual track: keep placing guardrails around personal tools rather than forcing every use case onto a single approved platform. The discovery priority has therefore widened. Teams must now inventory agents, remote MCP servers and local model infrastructure alongside the familiar chatbots.
Average AI users rose sharply, yet the mix of personal versus managed traffic stabilised. That plateau means permanent policy work on both sides of the fence.
Security Must Inspect What Comes Back
The 2026 threat landscape has moved beyond shadow AI discovery into a phase of bidirectional, agentic risk. We are no longer just monitoring the prompts employees send to third-party models; we are now governing the integrity of the AI supply chain.
Ray Canzanese, Director of Netskope Threat Labs, wrote those lines in the report’s framing. Ray Canzanese summarized the three shifts as downstream architectural risk, agentic coding as a new execution vector, and a weaponised AI supply chain that now includes trojanised developer tools and fake installers.
Crowd conversation on X around MCP security lands on the same weak point from a different angle. Agents often trust whatever a server returns. Poisoned tool metadata, missing authentication and command injection remain common; several independent tallies rate many of the top vulnerabilities as trivially exploitable. When an agent can read customer records or write files, the narrative it offers about its own actions can diverge from the actual trace. Defenders therefore need packet-level or gateway-level scores on every tool call, not just the final answer text.
Practical controls cluster around three layers. Visibility requires an AI gateway or proxy that sees shadow traffic, local models and MCP sessions alike. Governance needs a matrix of approved apps, use cases and data-access levels by user group. Protection adds real-time DLP on both directions, semantic output checks and behavioural alerts when an agent reaches credential stores or unexpected tables.
Malicious AI lures also rebounded after March 2026. Fake application installers, phishing pages dressed as AI tools and trojanised developer packages target the same productivity pressure that drives legitimate adoption. Users who already trust AI branding click faster.
What the Next Months Look Like for Defenders
Netskope expects MCP adoption and agentic coding to keep climbing through the second half of 2026, even as overall prompt growth begins to plateau. Downstream violation share should therefore continue rising. The firms that already sit in the top quartile for AI volume will feel the pressure first; their absolute weekly counts already exceed 200 downstream hits.
The report maps each risk category to concrete visibility, governance and protection steps drawn from frameworks such as MITRE ATLAS and the OWASP Top 10 for LLMs. The consistent thread is that every agentic interaction must be treated as a potential execution path, not merely a data request. That stance also intersects broader questions of AI governance and review that research communities and enterprises are still settling.
Organisations that still lack enforceable content-aware policies for genAI (roughly half, per earlier Netskope measurements) operate with incomplete detection. The observed doubling of downstream events is therefore a lower bound on the true exposure.
The architectural change is already live. Agents connected through MCP can return data that no human ever typed into a prompt. Security stacks built only for the outbound leg now leave the return path open.
Frequently Asked Questions
What is a downstream data policy violation in AI systems?
A downstream violation occurs when an AI service or agent returns sensitive information that the requesting user or agent is not authorised to access under organisational policy. It typically surfaces after MCP, RAG or custom models pull from internal stores and hand the result back without a second authorisation check.
What is the Model Context Protocol and when was it released?
MCP is an open standard that standardises how AI models and agents connect to external data sources and tools. Anthropic released it in November 2024; it defines hosts, clients and servers so a single integration can unlock many systems instead of custom connectors for each pair.
How much did MCP usage grow in the recent period covered by the report?
Over a ten-week window measured in the Netskope telemetry, the number of users accessing remote MCP servers increased 250 percent while MCP transactions rose 375 percent. Coding agents account for a large share of those connections.
Which data types appear most often in AI policy violations?
In upstream violations, regulated data and source code each represent 35 percent, intellectual property 20 percent and passwords or keys 10 percent. Downstream cases inherit the same sensitivity mix once agents gain reach into those stores.
Why do malicious code alerts matter despite low volume?
They register only five alerts per 10,000 yet carry critical severity because autonomous coding agents can execute returned code or fold it into larger codebases without a human gate. A single successful injection can therefore scale faster than traditional malware delivery.
