What the 2026 Verizon DBIR found on AI, and how MoorAI solves it

Verizon’s 2026 Data Breach Investigations Report covers incidents from November 2024 to October 2025. Its AI findings point to one place: the corporate device, where employees reach AI through accounts the company does not manage. AI coding agents raise the stakes there, because they run commands, read files and call tools. MoorAI checks those actions on the device, whatever account the agent is signed into.

What the DBIR found

Page numbers refer to the full report.

Personal accounts. 67% of users reach AI platforms from corporate devices with non-corporate accounts (p. 60).
Use tripled. 45% of employees use AI on their corporate devices at least once every 15 days, up from 15% a year earlier (p. 60).
Shadow AI leaks data. It is the “third most common non-malicious data leakage related activity”, according to Verizon’s press release.
Source code goes in first. It is the data most often sent to generative AI tools, by a large margin. Research and technical documentation appear in 3.2% of data loss prevention (DLP) events (pp. 60–61).
AI browser extensions. At the average company, more than 15% of users have unauthorized AI extensions installed (p. 60).
Attackers use AI too. Threat actors use it for targeting, initial access and malware development (p. 12), and the report expects AI agents to use service and machine accounts (p. 22).

How MoorAI solves it

MoorAI agent v1.17.1 is open source under MIT. Each answer below ends with where it stops.

Personal accounts: the check runs on the device

MoorAI runs in the agent’s own pre-tool hook and reviews every tool call before it runs. That covers Claude Code fully, and Codex CLI, Copilot CLI, Gemini CLI and Cursor through adapters. The hook lives on the device, not in an AI account, so a personal account gets the same check as a corporate one. The console receives a category, a risk level and a keyed one-way hash, never the content. Limit: the four adapters have not yet been tested end to end against the live agents.

Shadow AI and AI browser extensions: an inventory of each device

moorai-aibom lists the models, MCP servers, editor extensions, running local model servers and AI keys on a device. It reports each key as a hash, so the console can tell a company key from a personal one. The desktop app, on macOS and Windows, also lists AI browser extensions in Chrome, Edge, Brave, Arc, Vivaldi, Opera, Firefox and Safari, and in Chromium browsers flags those with broad access, such as reading every site. A daily check names any unknown program calling an AI provider’s API (AI_API_CALLER_UNKNOWN). moorai-shadow compares the AIBOM with your approved list. Limit: an extension counts as AI only if it is in MoorAI’s catalog, and the inventory shows that it is installed, not that it is in use.

Source code: control where the agent can send it

An approved list of model providers flags or blocks calls to any other provider, including through a redirected base URL. Egress rules decide which program may reach which host, and a per-agent destination map alerts the first time an agent reaches a new one. The model proxy checks what an agent sends its model for secrets and personal data, and the hook stops a secret file being read into the agent’s context. Limit: MoorAI does not recognise source code by its content. The control is on where code can go.

Chat in the browser: a companion extension

MoorAI Browser Guard, for Chrome and Edge, reviews a prompt typed into ChatGPT, Claude, Copilot, Gemini, Perplexity, Le Chat, DeepSeek or Grok before it is sent, whatever the account. It can block a secret, key, card number or private key. Limit: it is loaded unpacked, not from a store, and checks typed prompts, not file uploads.

Attackers: watch the AI already on the device

Four living-off-the-AI detectors flag an AI CLI started by an unexpected program, use of an opt-in decoy AI key, a local model server reachable without MoorAI, and an unknown program calling an AI API. Content an agent reads is scanned for injected instructions before it acts. Limit: MoorAI does not stop attackers’ use of AI on their own infrastructure.

Agent accounts: controls the agent cannot switch off

Agents in CI and containers run the same hook in server mode, in managed settings that a repository cannot override, with a per-service profile of allowed tools and hosts. Policy is signed, and the administrator chooses fail open or fail closed for each surface; nothing the agent can write changes the fail mode. For Claude Code, a per-session context tree records what entered the agent’s context, so an alert can show which source was behind an action. Limit: on the coding-agent hook, only the pre-tool check fails closed.

Limits

MoorAI governs enrolled devices. A device that is not enrolled only coaches, and a device without MoorAI is not seen.
It does not patch vulnerabilities, the report’s top way in, or assess third-party vendors.
It runs as the same user as the agent: governance, not a sandbox.

Sources

Verizon. 2026 Data Breach Investigations Report (PDF), pp. 12, 22, 60–61; Executive Summary (PDF), p. 12; press release, May 19, 2026; report page.
MoorAI. Agent v1.17.1 on GitHub: the README, browser-ext/README.md and the desktop app’s browser inventory in src-tauri/src/platform.rs.