Akamai Report: Shadow AI and Browser Extensions Cause Corporate Data Breaches
Akamai's 2026 Enterprise AI Usage Risk Report identified that unauthorized AI tools (shadow AI) and malicious browser extensions are exploiting security gaps in corporations, enabling new cyberattack vectors like vibe hacking, cursor jacking, and comet jacking that bypass conventional data loss prevention measures.
What happened
Akamai released the Enterprise AI Usage Risk Report 2026 on August 10, 2026, detailing how rapid adoption of autonomous AI technologies and dangerous browser extensions create new cybersecurity attack vectors that bypass conventional security defenses.
The report identified three new attack methods: vibe hacking (manipulating local markdown instruction files to trick AI coding assistants into generating vulnerable code), cursor jacking (malicious browser extensions leveraging broad access permissions to steal API keys and code bases from programming assistants like Cursor), and comet jacking (indirect prompt injection inserting malicious instructions on public web pages to trick local AI agents like Comet AI into leaking local files, emails, and session credentials).
Reported impact
Shadow AI—unauthorized use of AI applications without IT team authorization—and stealthy running browser extensions now represent critical gaps threatening important digital assets in enterprises.
According to Akamai's Vice President of Enterprise Security, sensitive corporate data is now systematically distributed through millions of prompts, unmanaged personal accounts, and autonomous AI agents, making conventional data loss prevention solutions designed for file transfer and email inadequate.
Index analysis
The rapid integration of AI technologies in corporate environments has outpaced the ability of existing security mechanisms to control and monitor their use, with adoption shifting from careful testing in 2025 to strategic necessity in 2026.
Governance controls
Akamai recommended that Chief Information Security Officers (CISOs) adapt from merely blocking AI to continuously managing its operational workflows, with recommendations including focused oversight and education for power users.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.