IBM 2026 Report: AI Breaches Target APIs, Not Models

Most AI-related system breaches happen through exposed APIs or misconfigured cloud storage, not by defeating the AI model itself. This is a key finding from IBM’s 2026 Cost of a Data Breach report. What's interesting is that while one in four malicious breaches are considered AI-enabled, they rarely involve outsmarting the model. Compromised APIs and cloud misconfigurations each accounted for 27% of breaches that reached an AI system. Furthermore, only 40% of organizations breached through their AI had access controls on their models and data. The average cost of a data breach reached $6 million, a 35% increase from the previous year. The United States saw an average cost of $11.5 million, nearly double the global average. Healthcare remains the costliest industry for breaches. The bottom line: attackers are targeting the infrastructure around AI systems, highlighting the need for robust security measures beyond just the AI model itself.