Summary: Gartner forecast on April 9, 2026 that 25% of enterprise generative AI applications will experience at least five minor security incidents annually by 2028, up from 9% in 2025, while applications with at least one major incident will rise from 3% in 2025 to 15% in 2029. It links the risk to MCP plus agentic AI and defines a no-go zone combining sensitive data, untrusted content, and external communication. Recommended controls include formal reviews, agent-specific identities, and domain ownership.
One April 9, 2026 forecast from Gartner lays out the trajectory: by 2028, 25% of all enterprise generative AI applications will be logging at least five minor security incidents a year; in 2025 the share was 9%. A year later, in 2029, applications hit by at least one major security incident annually will make up 15%, where 2025 stood at just 3%.
Taken on their own, the numbers hold few surprises. The surprise sits in the cause Gartner names: the Model Context Protocol (MCP) paired with agentic AI. Security incidents reaching this scale is no longer the familiar “the model isn’t safe” story; it is a new story in which agentic architectures lay the attack surface open.
25% and 15%: Reading the Two Figures
Under Gartner’s definition, a “minor incident” means five or more occurrences in a year, spanning data exposure, content injection attacks, supply chain threats, sensitive data disclosure, and privilege escalation — most of them born of situations where “AI tries to be helpful but makes a mistake.” Moving from 9% to 25% says this: within three years, one enterprise GenAI application in four will occupy the “breaks things on a regular basis” bracket. It is also worth noticing that Gartner never draws a hard boundary between minor and major incidents — frequency alone does the separating. That choice carries a message of its own: once incidents fade into background noise, automated triage and grading beat a case-by-case investigation.
The line with the steeper slope belongs to major incidents: 3% to 15%, a five-fold rise across five years. Aaron Lord, Sr. Director Analyst at Gartner, is blunt about it: MCP “was built for interoperability, ease of use and flexibility first, so security mistakes can manifest” when continuous oversight is missing. His advice is for leaders to work alongside data, security, and infrastructure teams to stand up a formal security review for MCP use cases.
The Storm’s Center: MCP
Through MCP, AI agents can attach to arbitrary tools and data sources, and the protocol has settled in as the de facto standard for agentic AI deployment. Its design priority, though, was developer speed rather than security enforcement: a tool description is itself untrusted input, third-party MCP components go through no review, and an agent’s permissions all too often inherit the human user’s role wholesale. Map Gartner’s named incident types — content injection, sensitive data disclosure, privilege escalation — back onto those paths and nearly every one of them lands there.
The trouble, in other words, lives not in any single component but in how components stack: an agent that can read, write, and reach the network gains one more misusable, injectable interface with every MCP server it attaches. The ecosystem’s present condition compounds this — server directories keep swelling, third parties maintain most of the servers, and an assigned owner or review process is rarely to be found inside enterprises. Gartner’s “domain-oriented ownership” recommendation aims straight at that hole.
Three Capabilities in One Place: the No-Go Zone
The judgment that carries the most weight in the forecast is the “no-go zone”: any use case holding access to sensitive data, ingestion of untrusted content, and external communication at once belongs on the exclusion list, because those three pieces assemble into a complete exfiltration chain. Picture an agent reading an external page (untrusted content), getting steered by the instructions inside it, and then sending internal documents out the door — no advanced exploit enters the picture; the flow is the vulnerability.
What makes the rule valuable is that it can actually be enforced: at design review, a product or security team runs down three checkboxes rather than debating how risky each case happens to be. Out in the field, the requests that cross the line most often wear an innocent face — “summarize this customer email and draft a reply” ticks untrusted input, sensitive context, and outbound sending in a single move.
What Engineering and Security Teams Can Do Now
All four actions below come directly from Gartner’s recommendations, and they can be rolled out in sequence:
- Stand up a formal security review process for MCP use cases, wave low-risk patterns through first and keep high-risk combinations out explicitly
- Issue agents their own authentication and authorization identities — never permissions inherited from human users — and scope those permissions to the minimum
- Put mitigations in place for known threat patterns, covering content injection defenses and the continuous review of third-party MCP components
- Run MCP servers under domain-oriented ownership: domain experts define guardrails ahead of time so client access is secure by default
Gartner pairs the forecast with companion research titled “Best Practices to Counter MCP Security Risks,” and the topic is on the schedule for deep dives at its Application Innovation & Business Solutions summits in Las Vegas, Tokyo, and London. Set this forecast beside Redwood Research’s AI risk snapshot (see the AI risk snapshot) and the two point the same way: risk is moving from “the model says the wrong thing” to “the agent does the wrong thing,” and the second of those lands squarely inside engineering and security teams’ jurisdiction, turning into a built-in engineering cost for every team adopting agentic AI.