Five weeks of Gartner statements, an OWASP working-group report, and a run of independent disclosures from CrowdStrike, LayerX, Mozilla’s 0DIN, and SentinelLABS landed between June 2 and July 8, 2026. Read individually, they’re separate stories — a prediction about unsanctioned tool use, a taxonomy update, a couple of browser exploits, a malware sample. Read together, they describe the same missing piece of infrastructure from four different angles: enterprises have no consistent point on the wire where a call to an LLM provider gets identified, inspected, and — if necessary — stopped. Below is what the last month’s research actually said, and why the fix keeps turning out to be a gateway problem rather than a model problem.

Shadow AI is now a measured quantity, not a guess

Gartner’s Emerging Risk Deep Dive: Shadow AI puts a number on what security teams have suspected for two years: more than 40% of global organizations will experience a security or compliance incident tied to unauthorized AI tool use by 2030, and 69% of surveyed cybersecurity leaders already have evidence — or a strong suspicion — that employees are using public GenAI tools the organization never approved.¹ Gartner is also forecasting AI governance spend to reach $492M in 2026 and cross $1B by 2030, which is a reasonable proxy for how fast this moved from “policy memo” to “budget line.”

The Verizon 2026 DBIR gives the more useful number, because it’s measured, not projected: AI tool use on corporate devices jumped from 15% in 2025 to 45% in 2026 — a threefold increase in twelve months — and 67% of that usage runs through personal accounts, meaning it never touches SSO, an API key, or anything a CASB would key off of.² Shadow AI is now the third most common non-malicious insider action showing up in DLP telemetry, a fourfold year-over-year increase. The composition of what’s leaking is the part worth sitting with: across 858,440 DLP events the DBIR analyzed, source code was the single largest category pasted into ungoverned LLMs, ahead of images and structured data, with technical documentation a distant 3.2%. That’s not “someone pasted a spreadsheet.” That’s proprietary code becoming, in the report’s own phrasing, “intellectual property in someone else’s training pipeline.”

Both reports converge on the same operational conclusion, stated more bluntly in the DBIR: prohibition policies fail, the way personal-email bans failed a decade earlier. The DBIR’s 90-day recommendation is to measure actual shadow AI prevalence with existing DLP/CASB telemetry, sanction an approved pathway instead of trying to block every unsanctioned one, and build tamper-evident logging of AI interactions with regulated data.² Gartner’s version is policy-first — define acceptable use, audit regularly, fold GenAI risk into SaaS vendor assessment.¹ Both assume you can see the traffic in the first place, and that’s the part that’s structurally hard: 67% personal-account usage on a managed device, over HTTPS, to a domain that looks like any other SaaS traffic, is invisible to anything that isn’t inspecting the connection itself. An agent that has to be installed and cooperate isn’t going to see traffic the user deliberately routed around sanctioned tooling. A proxy sitting at the network egress point, doing TLS interception on known AI provider domains, sees it regardless of which account the user is signed into.

Prompt injection moved from OWASP’s list to Gartner’s threat briefing

On June 2, Gartner named prompt injection one of four critical threats requiring urgent attention from cybersecurity leaders in 2026, alongside AI application compromise, deepfakes, and software supply chain attacks.³ It’s a small classification change with a real signal in it: Gartner grouped prompt injection with threat categories where, in its own framing, attackers currently have the advantage — not with the emerging-technology-risk bucket it might have sat in a year earlier.

The OWASP GenAI Security Project’s State of Agentic AI Security and Governance (v2.01, June 2026) makes the case in more technical detail.⁴ Across 53 tracked open-source agentic projects — 28 of them coding agents, which drive the majority of reported incidents — prompt injection maps to six of the ten categories in OWASP’s Top 10 for Agentic Applications. The report’s more uncomfortable finding is about velocity: seven of the surveyed projects ship releases daily or faster, and one (trycua/cua) averaged a release roughly every eight hours — faster than most security teams can review a diff, let alone a threat model. The March 2026 LiteLLM package compromise on PyPI, which pulled 47,000 downloads in three hours before it was caught, is what that velocity gap looks like when it goes wrong. Only 37% of organizations surveyed have any shadow-AI detection policy in place at all.

What actually happened in June is a useful illustration of “six of ten categories,” because every disclosure that month was indirect injection — the payload never comes from the user, it arrives inside content the agent was already trusted to read:

CrowdStrike pushed its prompt injection technique taxonomy past 200 entries, adding 18 in this cycle, including trigger-activated rule addition (dormant instructions that only activate on a later, unrelated condition), cognitive token suppression (targeting the model’s safety vocabulary directly), algorithmic payload decomposition (fragmenting a payload across turns to dodge single-pass filters), and unwitting user delivery (social-engineering a human into pasting the payload on the attacker’s behalf).⁵
Mozilla’s 0DIN disclosed (June 29) an indirect injection chain against AI coding agents, Claude Code among them: a malicious repository’s setup instructions look ordinary, a package is made to fail on purpose, the agent follows the “fix” — running an initialization command that resolves an attacker-controlled DNS TXT record and pipes the response to bash.⁶ The payload never exists as a literal string a static scanner, a code reviewer, or the agent’s own instruction-following would flag as malicious; the agent is doing exactly what it was told, the instructions were just attacker-authored.
LayerX’s “BioShocking” research (reported late June–early July) got six agentic browsers and extensions — including ChatGPT Atlas, Perplexity Comet, and an Anthropic Claude browser extension — to copy session credentials and pull SSH keys from a signed-in GitHub session, by convincing each agent that a fictional frame applied to the page until it stopped enforcing its own rules.⁷ OpenAI patched Atlas; Perplexity closed the report without acting; Anthropic’s fix reportedly didn’t hold up under retest.
SentinelLABS documented macOS.Gaslight, a Rust-based DPRK-linked macOS implant carrying an embedded 3.5 KB prompt-injection payload — 38 fabricated system messages (fake token-expiry warnings, out-of-memory kills, disk exhaustion, bogus static-analysis flags) built specifically to make an LLM-assisted malware-triage pipeline doubt its own session and abort analysis.⁸ SentinelLABS assessed with high confidence that the technique hadn’t yet defeated a production AI malware-analysis platform, but the jump from a single failure message to a tuned cascade of 38 suggests deliberate testing against live tooling — indirect injection being iterated on as an anti-forensics technique, not just a one-off trick.

The structural thread through all four: the untrusted content and the trusted instruction arrive over the same channel, get concatenated into the same context window, and the model has no reliable way to tell them apart afterward. Simon Willison’s “lethal trifecta” (private data access, exposure to untrusted content, and an outbound communication channel, all present at once) and Meta’s “Agents Rule of Two” are two independent attempts to name that same gap.⁴ Neither is solved by a better system prompt, because the system prompt is exactly the thing being overridden.

Legacy DLP wasn’t built for this shape of traffic — and the fix on the table isn’t “replace it”

The 2026 DLP commentary — CrowdStrike’s white paper on the topic, several vendor write-ups, and the DBIR’s own telemetry — converges on a specific complaint: legacy DLP was built to fingerprint files and regex-match structured fields moving through email and upload channels, not to inspect a live, unstructured prompt-and-response stream that changes shape on every request.⁹ ¹⁰

The fix that keeps recurring in these write-ups isn’t “buy a purpose-built AI-DLP suite and retire the old one.” Most enterprises already have a DLP engine — Symantec and similar products — with years of tuned policy, directory integration, and an audit trail regulators are used to seeing. The actual gap is narrower: nothing routes LLM prompt traffic through that engine. The pattern that shows up repeatedly is protocol-level, not product-level — intercept the prompt at the network layer and hand the raw text to the existing DLP server over its native inspection protocol (ICAP REQMOD is the common mechanism; proxies have used it for antivirus and content adaptation for two decades), so the DLP server applies its own directory-resolved, per-user policy exactly as it would for outbound email. That only works end to end if the proxy also tells the DLP server who is asking — propagating the authenticated username and source IP into the ICAP request — because without an identity header, a DLP server with per-user or per-group policy just evaluates its anonymous default and every targeted rule silently never fires.

Note: One operational detail from this research is worth flagging because it’s easy to miss in a lab test: a lot of DLP-side “ignore requests smaller than N KB” tuning is a legacy antivirus-era optimization to save inspection cycles on tiny bodies. Applied unchanged to chat traffic, it means a ten-byte sensitive prompt sails through the same clean-verdict path a genuinely empty request would, simply because it’s smaller than the server’s inspection floor — a gap that’s specific to bolting LLM traffic onto DLP infrastructure sized for email- and file-scale bodies, not chat-scale ones.

Gartner is now describing the gateway as required infrastructure, not an option

Gartner’s 2026 Hype Cycle for Generative AI and its Market Guide for AI Gateways formalize what a year of vendor activity had already been pointing at: a control plane between callers and model providers — authenticating the caller, enforcing per-key and per-user rate and cost limits, applying model access policy, and logging every call — is now positioned as foundational infrastructure, in the same category as an API gateway or a service mesh, rather than an experimental add-on.¹¹

Gartner’s April 28 guidance on managing “AI agent sprawl” is describing the same enforcement point from the identity side: as the number of agents and non-human identities calling models grows faster than anyone’s inventory of them, the only place that can still reliably answer “who called what model, with what data, and was that call actually allowed” is whatever sits on the wire — not the agents themselves, which are the thing being audited in the first place.¹²

Put next to the shadow AI numbers, this is the same argument stated twice. A gateway that a caller has to opt into only governs the traffic that opts in. The DBIR’s 67%-personal-account figure is, by construction, traffic that never touches an API key, an SSO session, or an agent framework’s own instrumentation — the only layer left to see it is the network path to the provider’s real domain, inspected before or during the TLS handshake, independent of which account or which client is making the call.

What this adds up to

None of the last month’s research points at “AI is risky” in the abstract — that framing was already stale. It points at something narrower and more solvable: a specific, missing enforcement point on a specific kind of traffic.

Injection filtering has to run on the traffic itself, not inside one application’s prompt template, because BioShocking and the coding-agent disclosures both show the attacker doesn’t care which framework a given team standardized on.
DLP has to reuse an organization’s existing engine and policy over its native protocol, with identity attached, rather than a parallel keyword list that inevitably drifts from what the real DLP policy says.
Shadow AI visibility has to come from intercepting traffic to providers’ actual domains, because the traffic that matters most is exactly the traffic that skips every account-based control.
And rate, cost, and model-access enforcement have to live at that same point, because the AI gateway Hype Cycle placement and the agent-sprawl guidance are two descriptions of the same missing inventory-and-policy layer.

This is the design premise we’ve built Arceris around: a transparent HTTPS proxy and API gateway that sits between clients and upstream providers, applies PII detection and prompt-injection filtering to the traffic itself, feeds prompts into an organization’s existing DLP infrastructure over ICAP with identity attached, and enforces rate limits, cost limits, and per-user model access centrally — rather than asking every application, agent, and browser extension to reimplement the same controls correctly. It’s not a novel idea; it’s the same argument Gartner is now making about API gateways in general, applied to a traffic type that happens to be a lot easier to abuse than a REST call.

Sources

Gartner: 40% of Firms to Be Hit By Shadow AI Security Incidents — Infosecurity Magazine, citing Gartner’s Emerging Risk Deep Dive: Shadow AI (also listed directly: gartner.com/en/documents/6714034)
Verizon DBIR 2026: Shadow AI Now a Top Insider Threat — Kiteworks
Gartner Identifies Four Critical Threats Requiring Urgent Improvements from Cybersecurity Leaders (June 2, 2026)
Prompt injection still drives most agentic AI security failures in production — Help Net Security, covering OWASP GenAI Security Project, State of Agentic AI Security and Governance, v2.01 (June 2026)
CrowdStrike Uncovers New Prompt Injection Techniques
Mozilla warns of indirect prompt injection risk in AI coding agents — Help Net Security (June 29, 2026, covering Mozilla 0DIN research)
BioShocking AI: “Gaming” the AI Browser and Escaping its Guardrails — LayerX; also New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials — The Hacker News
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox — SentinelOne
Detecting and Stopping Data Loss in the Generative AI Era — CrowdStrike
Generative AI DLP in 2026: Browser, Endpoint, SaaS & MCP Data Loss Prevention — Strac
Best AI Gateways Reviews 2026 — Gartner Peer Insights; Hype Cycle for Generative AI, 2026 — Gartner
Gartner Identifies Six Steps to Manage AI Agent Sprawl (April 28, 2026)