98% of 100 assessed AI agents carry the 'lethal trifecta,' per CSA research note

A CSA note on the AIRQ Q2 2026 assessment says 98 of 100 agents combine private data, untrusted input and outbound actions, and only 11% pass a baseline.

A Cloud Security Alliance research note (June 6, 2026) summarizes the AI Risk Quadrant Q2 2026 assessment of 100 commercial and public AI agents. Only 11% passed a baseline security benchmark. 98% carried the "lethal trifecta": access to private data, exposure to untrusted content, and the ability to take outbound actions. If you run a coding agent with repo and network access, this is your threat model. The note says coding agents ranked second in capability but eighth in defense.

Other findings in the note: 40% of agents sat in a high-capability, low-defense "Exposed Giants" quadrant that holds 60% of aggregate risk. Tool execution explained 76% of blast-radius variance. 83% of vendor-claimed defenses lacked independent verification. The note also says logging is not protection: 37% of agents scored well on audit logging but poorly on harm prevention.

Some things are unclear. We couldn't find the full AIRQ report, the note doesn't say which coding agents were scored, and we couldn't confirm the authors' independence.

The practical response is to make sure no single execution path holds all three legs. For coding agents, AgentPatterns.ai recommends cutting egress first, for example with docker run --network none agent-image. It also recommends keeping .env and key files out of the paths the agent can read. OWASP's DevSecOps guidance adds:

It treats isolation, not permission prompts, as the real boundary.

Sources