Share one API key across five AI agents, and a single compromised agent inherits the reach of all five. The attacker immediately benefits from the accumulated permissions of every workflow that the key touches. The forensic trail goes cold at the credential level because five agents on one account leave no record of which agent did what.

Sixty-nine percent of enterprises run agents with credential sharing somewhere in their deployments, according to VentureBeat’s June 2026 Pulse Research wave of 107 enterprises.

That one number explains the buying spree reshaping enterprise security this year. Palo Alto Networks, CrowdStrike, and Cisco have collectively bet more than $22 billion on it in the past year, targeting exactly the layer most enterprises in this survey haven’t finished building.

Palo Alto Networks completed its acquisition of CyberArk on February 11 for $21.1 billion in total consideration at close — a deal it announced last July at roughly $25 billion and the largest in the company’s history.

CrowdStrike closed its $740 million acquisition of runtime authorization platform SGNL and, by June 15, shipped the first product from the deal, Continuous Identity for AI Agents. CrowdStrike integrated SGNL in less than a year, delivering a product that validates every agent action in real time based on who owns it, who is calling it, and the device’s risk posture.

Cisco announced its intent to acquire non-human identity specialist Astrix Security on May 4 for a reported $400 million.

For a security director, this survey reads as a board-level question, not a trend line. It also surfaces a finding no competitor’s data shows, one that exposes which companies are the most at risk.

The data below is the first look at VentureBeat’s Q2 Agentic Security report, drawn from 107 qualified respondents at organizations with more than 100 employees. The full report will be released to attendees at VB Transform, the event in Menlo Park next week (July 14-15) focusing on enterprise autonomous agents.

Forty-five percent are final decision-makers for AI purchases. The sample skews mid-market, so read the numbers as the view from organizations adopting agent security right now rather than from the largest enterprises.

More than half of respondents, 54%, have already had an agent security incident or near-incident. Eighteen percent confirmed an incident, and thirty-six percent caught a near-miss before a breach. Security teams are stopping most of these events at the last control point in the chain, but the rest of the data shows how thin that margin is.

Your agents are sharing credentials

Only 32% of enterprises give every AI agent its own scoped, managed identity. Nearly half (48%) report that some agents have scoped identities, while many still share credentials. Another 32% say agents mostly run on shared API keys or borrowed human and service-account credentials. The survey question allowed more than one selection, and 24 of the 107 respondents chose multiple options — which is why the three categories sum to 112%. Deduplicated by respondent, 74 organizations, or 69%, flagged credential sharing in at least one answer.

One number explains why the acquisitions target this layer. A shared credential converts a single compromised agent into many, and CyberArk’s research puts machine identities at 82 for every human in organizations worldwide, with agents as the fastest-growing category of the ratio. Cisco made the same diagnosis when it bought Astrix, whose founders built the company around API keys, service accounts, and OAuth tokens. Cisco’s announcement calls those the credentials AI agents are now “using (and abusing)” to execute work at scale.

Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, described the mechanism directly in an interview with VentureBeat. Some AI systems have their own identities, he said, and in other cases “people give their identity to the AI to take action on their behalf, and that also further kind of murkies the water and makes it very complex.” The murk is the point, because when the identity is shared, attribution dies with it.

Exposure scales with size, and containment does not

Forty-nine percent of enterprises enforce scoped permissions at runtime, and 47% monitor and log agent activity, which can help reduce security incidents. Only 30% sandbox their highest-risk agents, the one control that limits blast radius when the first two fail. Isolation is what keeps a single compromised agent from becoming a deployment-wide event. Enterprises have funded detection and resistance, but the containment layer barely exists.

The sharpest finding in the survey, and the one no vendor report captures, shows up when you split results by company size. The incident rate is 49% for companies with 101 to 1,000 employees, but it shoots up to 63% for companies with more than 1,000. Sandbox isolation moves the other way, falling from 35% to 20% at the larger companies.

The chart above shows the same finding at finer granularity: the 49%/63% split above is a binary cut at 1,000 employees, while the bars here break incident rate and isolation rate into four size bands. The red line measures incidents and near-misses, and the navy tracks the one control that contains damage after everything else fails. At organizations with 101 to 250 employees, the two sit 7 points apart, but above 5,000, the gap blows out to 60 points. That top band pools the survey’s two largest size groups and holds only 15 respondents, so treat the number as directional. Larger enterprises run more agents across more systems, which drives incidents up while sandboxing, the engineering project that would contain them, goes unfunded. The enterprises with the most agents have the least isolation around them.

The deals target exactly those accounts. Palo Alto Networks, Cisco, and CrowdStrike sell to large enterprises first, where incident rates are highest and containment is the thinnest.

Guarded by whoever shipped the model

The model providers are the security layer. OpenAI’s built-in guardrails lead at 51%. Google Cloud reaches 36%, Microsoft Azure’s Purview and Copilot Studio DLP 35%, and Anthropic’s managed-agent controls 29%. Eighty-two percent of respondents name a provider-native or hyperscaler control as their single primary agent security layer.

The purpose-built specialists are in single digits, with Palo Alto Networks’ Prisma AIRS at 7%, CrowdStrike at 6%, and Okta for AI Agents at 4%. Zenity and the dedicated non-human identity platforms are at 3% each. Microsoft Entra Agent ID is the highest-penetration identity-specific control in the dataset at 13%, the only one from a hyperscaler, and it still falls outside the top four. Only 5% of enterprises run no dedicated agent tooling at all, and the rest have tooling that came pre-installed.

Bundled controls lead because they ship free and are enabled by default. Most filter prompts and outputs, but they do not give an agent its own identity or sandbox it. Hyperscalers sell identity-layer products, and Entra Agent ID is in the dataset at 13%, but adoption stays low. The two controls that reward incident data the most, scoped identity and isolation, are the two that the default stack does not include.

Prompt-and-output filters evaluate whether a call looks malicious. That is an intent problem, and intent cannot be solved at the language layer. CrowdStrike CTO Elia Zaitsev drew the line in an interview at RSAC 2026. “Observing actual kinetic actions is a structured, solvable problem,” Zaitsev said. “Intent is not.” CrowdStrike’s Falcon sensor walks the process tree on an endpoint and tracks what agents did, not what agents appeared to intend. A scoped identity and an isolation boundary give that sensor something to track, while a shared credential on a bundled guardrail does not.

Cloud security went through the same cycle a decade ago, and Palo Alto Networks, CrowdStrike, and Wiz built multi-billion-dollar businesses on the gaps native cloud controls left open. Agent security is tracking the same path faster. A misconfigured storage bucket sat open until a human noticed. A misconfigured agent exploits its own over-permissioning on every run, and no human is watching when it does. Merritt Baer, chief security officer at Enkrypt AI and a former deputy CISO at AWS, told VentureBeat that the default layer is thinner than enterprises assume. “Enterprises believe they’ve ‘approved’ AI vendors, but what they’ve actually approved is an interface, not the underlying system,” Baer said. “The real dependencies are one or two layers deeper, and those are the ones that fail under stress.”

Comfortable, unconvinced, and already shopping

Here is the contradiction worth a keynote slide. Enterprises rate their agent security tooling 4.2 out of 5, with value for money at 4.1 and ease of implementation at 3.9. Those scores would make most SaaS vendors envious.

Only 35% believe their AI-enabled defenses are ahead of AI-enabled attackers, while thirty-two percent call it roughly even. Twenty-one percent say attackers lead, and another 21% say it is too early to tell, showing how enterprises trust their tooling more than they trust its outcomes.

Budgets confirm it. Forty-six percent allocate 6 to 10% of the security budget to agent security, and a full third spend 5% or less. Half the sample has already had an incident or near-miss, but the funding does not match the exposure.

Fifty-nine percent plan to adopt, add, or replace agent security tooling within 12 months, and twenty-nine percent plan to move this quarter. OpenAI leads forward interest at 34%, followed by Google at 30%, Anthropic at 29%, and Azure at 25%. The dedicated vendors draw more interest looking forward than their current single-digit footprint suggests. Satisfied customers do not reshuffle this fast unless they know the stack they’re currently using is provisional.

Three moves for security directors

1. Inventory every agent’s credentials this quarter. Map which agents share credentials with other agents and which run on borrowed human or service-account identities. The goal is not one credential per agent. Agents that touch multiple systems need multiple scoped identities. The goal is zero shared credentials between agents and zero borrowed human identities. Thirteen percent of surveyed enterprises already run Microsoft Entra Agent ID. Okta for AI Agents and the non-human identity specialists sell equivalents. Shared and borrowed credentials are the first thing to eliminate.

2. Sandbox the riskiest agents first. Isolation is the least-adopted control at 30% and the only one that contains blast radius after prevention fails. Rank agents by the sensitivity of what they touch and isolate the top of the list. Above 1,000 employees, where isolation falls to 20%, this is the single highest-return move in the dataset. Sandboxing does not require replacing the agent or the platform. It requires a policy decision and an isolation layer.

3. Match the budget to the incident rate. A third of enterprises fund agent security at 5% or less of the security budget, even though more than half have already had an incident or near-miss. Nine percent allocate more than 25% today. The full report breaks out exposure and containment by company size, showing which bands carry the most risk and the least protection.

The board’s question is simpler. If one of our AI agents was compromised this afternoon, which systems did it touch, and whose credentials was it holding? For the 69% of enterprises running agents on shared credentials, the answer is a shrug. The trail goes cold at the key.

The full Q2 Agentic Security report, with the complete vendor matrix, industry cuts, and the full dataset behind these charts, debuts July 14 and 15 at VB Transform, held at Hotel Nia in Menlo Park. The open question it leaves is whether enterprises close the agent security gap on their own terms, or whether a confirmed breach closes it for them.

SambaNova last announced a $350m Series E raise in February.

Intel-backed SambaNova has secured $1bn in funding to expand its AI chipmaking business, as demand for its inference technology continues to grow.

The Series F round, which drives up SambaNova’s valuation to $11bn, was led by General Atlantic, with participation from long-term backer Intel Capital, alongside Cambium Capital, BlackRock and the Qatar Investment Authority.

A&E Investment, Assam Ventures, Battery Ventures, Kabila Capital, QFO Capital, Vista Equity Partners and Volantis also participated in the raise.

The new capital comes at a time of accelerating momentum for SambaNova, which last announced a $350m Series E in February.

In recent months, the company launched its specialised SN50 chips that prioritise token efficiency, and announced a multi-year collaboration with Intel to deliver cost-efficient AI inference solutions to customers and roll out an Intel-powered AI cloud.

The 2017-founded SambaNova has close ties with Intel, whose CEO Lip-Bu Tan serves as chair of SambaNova’s board.

SambaNova said it will use proceeds from the latest raise to expand capacity, accelerate product innovation and scale deployments. Continuing on its growth momentum, the chipmaker plans to continue investing across chips, systems, software and full-stack AI infrastructure.

Alongside the funding, SambaNova has announced JPMorganChase as its latest customer to deploy the SN40 and SN50 chips.

“SambaNova’s platform is differentiated, built for a market where inference has become foundational to enterprise and industry transformation,” said Martín Escobari, the co-president and head of global growth equity at General Atlantic.

“Rodrigo and the team are driving deep technical innovation to achieve growing commercial momentum while demand for inference is accelerating well ahead of supply. We are pleased to lead this round to support SambaNova in shaping the next generation of AI infrastructure.”

SambaNova co-founder and CEO Rodrigo Liang told CNBC last month that “business is growing at an incredibly rapid rate”, adding that he is “really excited” about the current IPO market.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Earlier this week, Bloomberg reported that Microsoft was replacing some of OpenAI’s software with its own in-house models in an effort to cut costs. Those in-house models, known as MAI, were increasingly being used to power apps like Word and Excel, the outlet noted.

The story raised an increasingly common question about the two companies, which were once seemingly inseparable, and have recently sent mixed signals about the status of their situationship: Were the two companies drifting apart?

Now, OpenAI is attempting to put any insinuations of such a break to rest. During OpenAI’s launch of GPT 5.6 on Thursday, the company announced that it would become the “preferred model” powering Microsoft’s 365 Copilot.

OpenAI noted in a blog post published Thursday that GPT 5.6 would support Microsoft users across the company’s suite of productivity apps, including Word, Excel, PowerPoint, and Cowork.

“Our partnership with Microsoft has always been about bringing the benefits of advanced AI to more individuals and organizations, and we’re excited to continue building on that shared commitment,” OpenAI wrote in a blog post.

What being a “preferred model” actually means isn’t entirely clear, other than that OpenAI’s software will continue to power Microsoft’s apps.

That said, it was never reported that ChatGPT’s software would stop powering Microsoft’s apps — merely that Microsoft was relying increasingly on its own software in an effort to reduce costs. The new “preferred model” disclosure doesn’t appear to negate that previous reporting.

On Thursday, multiple news organizations accused OpenAI of withholding evidence about how the company trains its artificial intelligence models in a new motion that’s connected to a series of ongoing copyright lawsuits.

The motion was filed by 17 publishers, including The New York Times, the New York Daily News, the Chicago Tribune and Ziff Davis (CNET’s parent company). Ziff Davis sued OpenAI in 2025, alleging that OpenAI scraped its copyrighted works to train ChatGPT and other large language models.

Advertisement

The initial lawsuit dates back to 2023 when The New York Times first sued OpenAI and Microsoft, alleging the companies built their AI technologies using millions of news articles written by journalists. Microsoft and OpenAI have denied the claims.

The motion asks the court to impose legal sanctions against OpenAI, but not Microsoft, for allegedly withholding evidence, such as datasets and output logs, and claims that “OpenAI chose obstruction” by failing to produce it. If those sanctions are granted, OpenAI could be ordered to pay financial penalties. 

“This motion asks the court to punish OpenAI for hiding and destroying evidence showing how ChatGPT was trained on stolen journalism,” New York Daily News attorney Steven Lieberman said, per the Associated Press. 

At the center of the lawsuits is how generative AI, such as ChatGPT, is trained and how it sources its information. The Times’ original lawsuit claims that OpenAI’s generative AI tools “can generate output that recites Times content verbatim, closely summarizes it, and mimics its expressive style,” raising questions of copyright infringement.  

The lawsuits come amid a broader conversation in the journalism industry: declining traffic across digital media outlets. AI overviews are often cited as a major reason for the decline in clicks to original reporting by writers and editors, which in turn impacts publishers’ advertising revenue. 

A growing reliance on AI chatbots for finding news and other content is also a major concern for publishers, as it siphons off loyal readership and audience. Some data shows that small publishers have been hit the hardest, with a reported 60% traffic drop, while another analysis predicts traffic declines of more than 40% by 2029.

A statement by Ziff Davis notes that “OpenAI has copied and monetized Ziff Davis content without permission on a massive scale.” Lance Koonce, partner at Klaris Law and counsel for Ziff Davis, said that, since the lawsuit, “OpenAI repeatedly lied about its ability to search its own data sets for Ziff Davis content and engaged in other serious litigation misconduct.”

An ongoing debate over copyright and AI 

OpenAI has long maintained that AI training is fair use. An OpenAI spokesperson denied the allegations in a statement to CNET, stating: “As the Times’ case weakens and they’ve been forced to drop claims against us, they’re persisting with their efforts to invade the privacy of people who have nothing to do with this case, including by making these blatantly false allegations.” The statement went on to say: “We’ll continue defending our users’ privacy and the long-established principles of fair use.”

In a 2024 rebuttal to the original lawsuit filed by The New York Times, OpenAI said the publisher falsely accused the company of destroying data and instead accused the newspaper of “secretly” deleting its own data that would have shown internal use of OpenAI products. Although the Times has dropped one claim against OpenAI, the larger lawsuit remains in litigation.

Other tech giants, including Meta, have also been accused by authors and news publishers of copyright infringement. Many of those cases are still in litigation as courts decide where to draw the line between fair use and infringement in the age of AI.

A walk through the trees turned up more than expected a few years ago. One person spotted a plastic Nintendo 64 cartridge half-hidden on the forest floor. Its paper labels had vanished completely, leaving no hint of what game sat inside. The finder brought it home, then passed it along to someone who fixes old consoles for a closer look.

Rust had plainly gotten hold of the metal shield that covers the back, which is normally sealed up tight. The plastic shell that surrounded it had accumulated stains and scrapes from all of its time spent outside over the months or years, not to mention wear and tear. Inside, the circuit board, which is what actually matters, revealed some considerable corrosion around the vias on one side and a rougher surface on the other, and to top it all off, some of the screws had come free, adding to the overall ‘battered’ aspect. The real test would be when someone finally opened it up and attempted to get the parts to work again. First, you’ll need the right screwdriver, which should be a game-bit. When you take the shield off, you’re left with a wonderful mess of heavy crust and pitting across the metal underneath. Given the state of the outside, the board itself appears to be far superior to what you might assume. The pins on the edge connector are still in good condition, with no major damaged traces or fried components visible at first examination.

The next step was to clean it, starting with the board, then using high-strength isopropyl alcohol and a delicate brush. The residue is quickly removed without causing any damage, and the contacts can be polished with a Q-tip to look their finest. To be honest, the board appears very clean, nearly immaculate in sections. And the rusting hasn’t really taken hold, which is a comfort. In contrast, the shield and plastic shell told a different tale. Vinegar soaks appeared to dislodge some of the rust, and a combination of wire brushing and hot soapy water removed the most of the gunk. Some of the lighter stuff was removed with a magic eraser, but there is still some discoloration. If you were to restore it to its original condition, you’d probably have to replace the entire shell and shield, which would be a significant undertaking.

Before even attempting to boot the thing, he gave the N64 console a quick scrub just to be safe, and used an old cleaning kit to thoroughly clean the cartridge slot. One of the other known functional games proved that the device boots up normally. Then it was time to verify if our mystery cartridge was still functional. Slide it in, hit the power button, and the familiar title screen shows immediately.

The game was, of course, Super Mario 64, as the markings on the ROM chip showed that it was the regular version, with no special hardware or hidden modifications.The save data was particularly noteworthy, as someone’s previous progress was still present, intact, after years of exposure to moisture and temperature fluctuations. Unlike several other N64 games, Super Mario 64 keeps its saves in a non-battery-dependent manner. That was a pleasant surprise, even if the cartridge still appeared a little rough.

You have to give Nintendo credit because these cartridges were engineered to survive far more than a few scrapes and scuffs. They’re designed to endure dust and harsh handling by children, as well as repetitive insertion and removal, and it turns out the strong plastic shell and metal shield worked harder than we thought. They shielded the electronics within from the woodland environment considerably better than anyone could have anticipated. The shield, in particular, did an excellent job of soaking the majority of the corrosion that had developed in, leaving the board and pins in good shape. One final touch: a quick print of a new label to cover up the old one.
[Source]

Strands is the NYT’s latest word game after the likes of Wordle, Spelling Bee and Connections – and it’s great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc’s Wordle today page for the original viral word game.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc’s Wordle today column covers the original viral word game.

Good morning! Let’s play Connections, the NYT’s clever word game that challenges you to group answers in various categories. It can be tough, so read on if you need Connections hints.

What should you do once you’ve finished? Why, play some more word games of course. I’ve also got daily Strands hints and answers and Quordle hints and answers articles if you need help for those too, while Marc’s Wordle today page covers the original viral word game.