Google's Cybersecurity Forecast 2026: AI Agents, Prompt Injection, and the Agentic SOC

AI Security Series #25

Google Cloud's security teams — including Google Threat Intelligence, Mandiant Consulting, and Google Cloud Security — just released their Cybersecurity Forecast 2026. Unlike vendor marketing dressed up as predictions, this report draws on frontline incident response data and threat intelligence from one of the largest security operations on the planet.

The headline: AI is transitioning from the exception to the norm — for both attackers and defenders. But the specific predictions around prompt injection, agentic identity management, and "Shadow Agents" deserve attention from anyone building or securing AI systems.

AI Threats: What Google Expects

The report dedicates significant space to AI-related threats, treating them as the defining shift for 2026.

Adversaries Fully Embrace AI

Google anticipates threat actors will "fully leverage AI to enhance the speed, scope, and effectiveness of operations" across social engineering, information operations, and malware development. The key word is "fully" — they're projecting a transition from experimental use to standard operating procedure.

More concerning: they expect threat actors to "increasingly adopt agentic systems to streamline and scale attacks by automating steps across the attack lifecycle." This isn't theoretical. It's the logical progression of what we're already seeing with AI-assisted reconnaissance and phishing.

Prompt Injection Goes Mainstream

The report calls out prompt injection as "not just a future threat; it's a present danger" and anticipates "a significant rise in these attacks throughout 2026."

Their reasoning: increasing accessibility of powerful AI models plus growing business integration creates "perfect conditions for prompt injection attacks." They expect attackers to move from proof-of-concept exploits to "large-scale data exfiltration and sabotage campaigns" targeting enterprise AI systems.

Google describes their own defense approach as "multi-layered defense-in-depth" including model hardening, ML content classifiers to filter malicious instructions, "security thought reinforcement" to keep models focused on user intent, and strict output sanitization with user confirmation for high-risk actions.

AI-Enabled Social Engineering

The report highlights ShinyHunters (UNC6240) as a case study in sophisticated social engineering that avoids technical exploits entirely. Their prediction: voice phishing (vishing) will incorporate AI-driven voice cloning for "hyperrealistic impersonations" of executives and IT staff.

The uncomfortable truth they note: "Given the huge success of these social engineering campaigns and the difficulty in apprehending the actors at a deterrent scale, the risk-reward ratio will continue to favor the attackers."

The AI Agent Security Problem

This section of the report is particularly relevant given the rapid adoption of AI agents in enterprise environments.

Agentic Identity Management

Google predicts the rapid adoption of AI agents "will introduce new challenges, since traditional security deployments were not designed to be operated by AI agents." Organizations will need new methodologies to map their AI ecosystems and assess security vulnerabilities.

Their key prediction: "The concept of identity will expand to treat AI agents as distinct digital actors, each with its own managed identity." This requires moving beyond human authentication and service accounts toward "agentic identity management" — adaptive, AI-driven systems for continuous risk evaluation and context-aware access.

They emphasize least privilege, just-in-time access with temporary task-specific permissions, and "a robust chain of delegation." This aligns with the identity challenges we've been tracking in the NIST AI Agent Standards Initiative.

Shadow Agent Risk

The report introduces "Shadow Agent" as the evolution of Shadow AI: employees independently deploying autonomous AI agents for work tasks without corporate approval. This creates "invisible, uncontrolled pipelines for sensitive data" leading to potential data leaks, compliance violations, and IP theft.

Their advice: banning agents isn't viable because it drives usage off the corporate network and eliminates visibility. Instead, organizations need "a new discipline of AI security and governance" with a secure-by-design approach, AI controls to route and monitor agent traffic, and environments that "allow for AI innovation while maintaining auditable security."

The Agentic SOC

On the defender side, Google describes a fundamental shift in security operations.

By 2026, they expect analysts to move past "drowning in alerts" into directing AI agents. An alert will come "packaged with a full, AI-generated case summary, a decoded view of that obfuscated PowerShell command, and its mapping to the MITRE ATT&CK framework." The analyst's job shifts from manual data correlation to strategic validation.

For threat hunting, an analyst will be able to ask in plain English: "Hunt for TTPs related to UNC5221 across our environment and report anomalies." The AI handles petabytes of data; the analyst focuses on high-level analysis and judgment.

Their framing: "It's about scaling human intuition, not replacing it."

Cybercrime: Ransomware and Beyond

The non-AI sections are equally important.

Ransomware Continues to Escalate

Q1 2025 saw 2,302 victims on data leak sites — "the highest single quarter count observed since we began tracking these sites in 2020." Ransomware and data theft extortion remains "the most financially disruptive category of cybercrime globally."

Sandra Joyce, VP of Google Threat Intelligence: "We expect to see more ransomware and extortion. This problem is going to continue and increase in 2026."

Enterprise Virtualization Under Threat

Google predicts a "significant pivot" toward targeting virtualization infrastructure — hypervisors and the underlying fabric that hosts enterprise applications. The reasons: lack of EDR visibility, outdated software versions, and insecure default configurations.

Hypervisor attacks are designed for systemic disruption: "Bypassing in-guest EDR, they execute mass encryption of foundational virtual machine disks, crippling control planes and inducing enterprise-wide operational paralysis." The speed is the differentiator — "hundreds of systems inoperable in a matter of hours" versus days or weeks for traditional endpoint ransomware.

ICS and OT Targeting

The primary threat to industrial control systems remains cybercrime, not nation-states. The vector: ransomware targeting enterprise software (ERP systems) that disrupts "the supply chain of data essential for OT operations." Compromise the business layer, cripple the industrial environment, force quick payment.

Nation-State Activity

Brief summaries of each actor's expected focus:

Actor	2026 Focus
Russia	Shifting from tactical Ukraine support to long-term global strategic goals; renewed use of novel TTPs; pro-Russian IO intensifying against Western nations
China	Highest volume globally; targeting edge devices, zero-days, third-party providers; semiconductor sector focus; pro-PRC IO shaping global perceptions
Iran	Regime stability and regional influence; escalating cyber espionage, disruptive attacks, IO targeting Israel and allies; elevated wiper deployment risk
North Korea	Revenue generation via cryptocurrency theft ($1.5B heist in 2025); IT worker expansion to Europe; deepfake videos for social engineering

Charles Carmakal, CTO of Mandiant Consulting: "Nation-state adversaries will continue to penetrate organizations and remain within victim environments for large periods of time."

What This Means for Healthcare

Several predictions in this report have direct healthcare implications:

Prompt Injection and Clinical AI

As healthcare organizations deploy AI assistants for clinical documentation, patient communication, and decision support, prompt injection becomes a patient safety issue. An AI system manipulated into providing incorrect medical information or bypassing access controls could have consequences beyond data breach. Google's multi-layered defense approach — content classifiers, security thought reinforcement, output sanitization — should be standard requirements for healthcare AI deployments.

Shadow Agents in Healthcare

Healthcare workers are already adopting AI tools faster than IT can govern them. The "Shadow Agent" problem is acute in healthcare where clinicians may deploy AI agents to help with documentation, prior authorizations, or patient communication without understanding the data flows involved. The HIPAA implications of "invisible, uncontrolled pipelines for sensitive data" are obvious.

Virtualization and Healthcare Infrastructure

Healthcare organizations heavily rely on virtualized infrastructure. The prediction that hypervisor attacks can render "hundreds of systems inoperable in a matter of hours" should prompt immediate questions: Do we have EDR visibility into our virtualization layer? Are our hypervisors patched and properly configured? What's our recovery plan for a hypervisor-level attack?

Supply Chain Data for OT

Healthcare has significant OT exposure — medical devices, building systems, imaging equipment. The prediction that ransomware will target "the supply chain of data essential for OT operations" maps directly to healthcare scenarios where clinical systems depend on enterprise data flows. Network segmentation between IT and OT/medical device networks isn't optional.

The Bigger Picture

Google's forecast aligns with what we've been tracking in this series: AI is accelerating existing attack patterns while creating new categories of risk around agents, identity, and prompt injection. The "Agentic SOC" vision is compelling, but it requires organizations to first solve the agentic identity problem — and most haven't started.

The Shadow Agent prediction is particularly important. Organizations that try to ban AI agent use will lose visibility into how their data is actually flowing. The path forward is governance that enables safe innovation, not prohibition that drives usage underground.

For healthcare specifically, the combination of prompt injection risks, Shadow Agent data flows, and virtualization vulnerabilities creates a compound threat surface. Security teams need to be thinking about AI governance not as a future concern but as an immediate operational requirement.

This is entry #25 in the AI Security series. For related coverage on AI-powered vulnerability discovery, see Claude Code Security: Anthropic's AI-Powered Vulnerability Scanner Is Here.