Model wrappers are now cybersecurity’s next big attack surface: recent incidents show why

By 2026, the layer wrapped around AI chatbots and agents is becoming a security target of its own. That layer includes the prompts, context, permissions, workflows, APIs, and data that determine what a model can see, which tools it can use, and whether its output turns into a command, a file write, or an API request. Recent incidents point in the same direction: attackers are going after that wrapper, not the model itself.

The research already shows it. Elad Meged said GitHub issues gave him a way into repositories linked to Anthropic. Separate 2026 work showed agents writing to GitHub repos. Lasso Security pushed attack success from 1% to 24% by changing the plumbing while keeping the model, prompt, and tools exactly the same. Then there are the hidden add-ons. Michael Bargury at Zenity found credential-stealing malware inside model skills that still passed Anthropic and Cisco scanners.

If you build or use model-powered apps on a regular basis, pay attention to this. By 2026, 61% of enterprise applications used AI chatbots or agents, incidents were up 56.4%, 76% reported prompt injection, and 66% saw vulnerable code written by models. SOC 2, GDPR, and early SAFE efforts are still leaving companies with a patchwork of standards. There’s nothing to download here, but the risk cuts across the tools you already use.