One in four malicious data breaches involved attackers using AI, according to the 2026 Cost of a Data Breach Report IBM published on July 29, 2026. Those breaches cost an average of $6 million, roughly $1 million above the $4.99 million global average IBM reports across its full sample, and the share of malicious breaches with an AI component rose 56% from the prior edition.
The figures come from a survey, and that shapes how much weight they carry. Ponemon Institute conducted the research; IBM sponsored, analyzed and published it, and sells the detection, data-security and identity products its recommendations point toward. The sample is 602 organizations that were breached between March 2025 and February 2026, not a census of all attacks. IBM’s global average also moved up over the year: last year’s edition put it at $4.44 million and described that as the first decline in five years.
What the reported attacks look like
IBM says deepfake impersonation and AI-enabled malware account for most of what respondents classified as AI-enabled intrusion. Its UK newsroom summary of the same report breaks the category down further: deepfake impersonation at 45%, AI-enabled malware at 19% and phishing campaigns at 17%. That distribution puts most of the category in social engineering rather than autonomous code execution, and fraud teams at banks have been tracking the same pattern in AI voice-cloning attacks for over a year.
Sector concentration is the more consequential number. IBM reports that 62% of the AI-driven attacks in its dataset hit critical infrastructure, with financial services and energy carrying the heaviest share. Breaches at financial-services firms averaged $6.3 million and at energy companies $5.2 million.
AI systems were also targets rather than just tools. More than 20% of organizations reported a breach involving an AI model or application, up from 13% in the 2025 edition. The two leading causes IBM identifies are compromised APIs, applications or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%) — the infrastructure wrapped around a model rather than the model itself, which is also where the Hugging Face agent intrusion started.
The capability the survey asks about
A follow-on study run in May 2026 went back to 456 of the original 602 organizations and asked about frontier models with advanced cyber capabilities, naming Mythos specifically. Of that group, 78% said they were aware of reports about such systems, and 85% said they planned to increase security spending on the strength of that awareness. In the main survey, 64% said an actual breach would prompt more spending. Anticipated capability is now moving budgets faster than experienced loss.
That capability has been documented in technical detail. Anthropic’s Frontier Red Team published an assessment on April 7, 2026 reporting that its Claude Mythos Preview model found and exploited zero-day vulnerabilities in every major operating system and web browser it was pointed at. In one case it identified a 17-year-old remote-root flaw in FreeBSD’s NFS server, later catalogued as CVE-2026-4747, and wrote a working exploit with no human involvement after the initial prompt.
The costs the team published are the part defenders should read twice. A thousand runs of its bug-finding scaffold against OpenBSD came to under $20,000, and the single run that produced the critical finding cost under $50. Converting already-patched public vulnerabilities into working privilege-escalation exploits ran under $1,000 and under $2,000 apiece, each in a day or less. Anthropic also reported that fewer than 1% of the vulnerabilities it had found were patched at the time of publication. Other security vendors have described the same shift in AI moving from assistant to operator on the offensive side.
Where security teams have put their agents
IBM’s data locates the deployment gap exactly where that economics bites. More than half of organizations said they use agents for threat detection and containment; 18% apply them to vulnerability management. Three quarters said frontier AI threats are prompting them to reconsider how agents are deployed across security operations.
“When organizations have an extended gap between discovery and remediation, that imbalance shows up directly in breach costs,” said Suja Viswesan, VP of IBM Security Software, in the report announcement. “The priority now is to eliminate that lag.”
Other foundations have not moved much. Among breached organizations, 37% encrypt sensitive data both at rest and in transit, and 34% have visibility into their cryptographic assets. Ransomware appeared in 39% of reported incidents, up from 34%, with extortion pressure shifting toward brand reputation (41%) ahead of employee data and intellectual property, consistent with the fragmentation in the ransomware economy other trackers documented in 2026.
Organizations using AI and automation extensively across security operations spent about $2 million less per breach, IBM says, and roughly a quarter of the sample has not adopted them at all. Both IBM and Anthropic point at the same lever: compress the time between a vulnerability becoming known and a fix reaching production. The 18% figure is where that work currently sits, and it is the number to watch in next year’s edition.
