Prompt Injection Just Became One of the Most Expensive Breach Types IBM Tracks
IBM's 2026 Cost of a Data Breach Report, published in late July, puts the global average cost of a breach at $4.99 million, a new record and a 12% increase year over year. The report attributes a meaningful share of that increase to a specific category: AI-driven attacks, which rose 56% and added an average of roughly $1 million to the cost of an incident once one occurred.
Buried inside that top-line number is a more specific finding that matters more for anyone actually building on top of AI models. When IBM broke out AI-related incidents by attack type, model inversion attacks averaged $6.07 million per breach and prompt injection averaged $5.89 million, making them the two most expensive categories IBM tracked this year, ahead of more familiar breach types like stolen credentials or misconfigured cloud storage.
What's actually driving the cost
Model inversion is what happens when an attacker doesn't steal a database directly but instead queries a model repeatedly until its outputs reveal the sensitive training data underneath, personal records, proprietary text, confidential documents, reconstructed without ever touching the original source. Prompt injection is more familiar by now: crafted input, often hidden in a document, email, or web page an agent is asked to process, that bends the system's instructions to the attacker's goal instead of the user's.
What IBM's researchers found is that neither of these attacks tends to start with a flaw in the model itself. The incidents traced back to compromised APIs, connected third-party applications, plug-ins, and cloud misconfigurations, the connective tissue around the model rather than the model's own weights. That distinction matters, because it means patching the model doesn't fix the exposure. Patching the access path does.
The governance gap is the headline, not the footnote
The most striking figure in the report isn't a dollar amount. It's a percentage: 92% of organizations that experienced an AI-related security incident had no proper AI access controls in place at the time. Separately, AI-model and AI-application security incidents hit 21% of all breached organizations this year, up from 13% the year before, and a large share of breached organizations reported having no formal AI governance policy at all.
Read together, those numbers describe a specific failure mode: companies adopted AI tooling and agentic workflows faster than they built the access controls to govern them, and the breach cost is now measuring that gap directly. This is consistent with what other 2026 trackers have found in the same window, including reports of AI agents running with far broader access than their tasks require. The cost data and the access-governance data are describing the same underlying problem from two different angles.
- Does every AI agent or model integration in your stack have a documented, minimal scope of access, or was it granted broad permissions "to be safe" during setup?
- Can you produce an audit trail of what a given agent or model actually did with its access, after the fact, not just what it was authorized to do?
- Is there a written AI governance policy that someone outside the engineering team has actually reviewed, or does one exist only informally?
- Who reviews connected AI integrations and their scopes on a recurring schedule, rather than only at initial setup?
None of this is a reason to slow down AI adoption. It's a reason to stop treating access scope as an afterthought. At $5.89 million and $6.07 million per incident, the two most expensive breach categories IBM tracks this year are the ones access controls were specifically designed to prevent.