Zscaler Report: Critical Vulnerabilities Found in 100% of Enterprise AI Systems
Zscaler's 2026 report on AI security found critical vulnerabilities affecting all enterprise AI systems studied, with a median breach time of 16 minutes. The analysis also documented massive volumes of corporate data transferred to public AI tools, including ChatGPT and Grammarly, with hundreds of millions of data loss prevention policy violations detected.
What happened
Zscaler's ThreatLabz 2026 AI Security Report, published on January 27, 2026, analyzed 989.3 billion AI and machine learning transactions across its Zero Trust Exchange platform during 2025. The report found critical vulnerabilities in 100% of the AI systems and applications observed, with a median time to first critical failure of 16 minutes and 90% of systems compromised in under 90 minutes.
During 2025, enterprise users transferred 18,033 TB of data to AI/ML applications, a 93% year-over-year rise. ChatGPT received 2,021 TB of enterprise data and was tied to 410 million data loss prevention (DLP) policy violations, including attempts to share social security numbers, source code and medical records. Grammarly received 3,615 TB of enterprise data.
Reported impact
The report noted that AI adoption is accelerating faster than enterprise oversight, creating a rapidly widening attack surface across all sectors. The scale of data transferred to consumer AI applications has transformed tools like ChatGPT and Grammarly into concentrated repositories of corporate intelligence.
Index analysis
Enterprise AI activity was concentrated in the US (38% of transactions), followed by India (14%) and Canada (5%). Finance and insurance accounted for 23% of all AI/ML traffic, while technology and education sectors recorded year-over-year growth of 202% and 184% respectively. Engineering represented 48.9% of all AI usage, followed by IT (31.8%) and marketing (6.9%).
Governance controls
The report noted that despite 91% AI usage growth across more than 3400 AI applications, many organizations still lack a basic inventory of AI models and embedded AI features. Zscaler analysts concluded that AI governance has transitioned from a policy discussion to an immediate operational necessity.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.