AI's new data leak: the answers, not the questions

Most enterprise AI security incidents are still about data going out: secrets pasted into a chat box, sensitive records uploaded to a model. A second line on the dashboard is doubling year over year, and the shape is the opposite. It is what an AI system brings back without permission: information returned to a user, or to an agent acting on a user's behalf, that the person was never meant to see.

The technical name for the new line is a downstream AI violation: an AI service hands information to a user or an agent they were not authorized to access. The mechanical reason it is growing is an open standard called Model Context Protocol, or MCP. Published in 2024, MCP is the plumbing that lets a model or an agent call out to file shares, customer databases, internal APIs, and code repositories, then act on what comes back. In a 10-week window, the number of users reaching remote MCP servers rose roughly 250% and MCP transactions rose roughly 375%, per Netskope's 2026 Cloud and Threat Report.

The numbers on the downstream line are still smaller than the upstream one. Netskope's 2026 telemetry puts downstream violations at 924 for every 10,000 AI alerts it classifies, against 8,752 upstream data-policy violations in the same window. What changed is the growth rate. Average downstream violations per organization rose from 12 to 31 per week year-over-year, more than doubled. The top quartile of organizations, the firms with the most AI in production, saw downstream violations move from 72 to 206 per week over the same window.

The reason MCP matters is that it changes who, or what, is reading. A user typing a prompt into a chat box is the only one who sees the answer. An MCP-connected agent can call a database, summarize a customer file, or pull a code snippet and then route the result to another system, with no human reading the intermediate steps. When the underlying access control is loose, the agent can return information the requesting user was never cleared to see, and the audit log shows an authorized service call rather than a data leak. The 250%/375% MCP growth is not just a curve on a chart. It is the rate at which this new surface is being added to enterprise stacks.

Per 10,000 AI alerts, Netskope also counts 154 content-filtering hits, 129 prompt-injection and jailbreak attempts, 28 deliberate sensitive-information requests, and 5 malicious-code cases. Downstream violations, the line tied to connected systems, sit ahead of all four.

The data behind the curve is single-source. Netskope, the firm behind the report, sells the SSE platform that produces the telemetry, and the figures are not independently audited. The downstream/upstream split is Netskope's own taxonomy, which leans naturally toward the categories its product covers. Upstream violations still outnumber downstream by roughly nine to one. Shadow AI use, the share of employees reaching AI tools without IT sign-off, fell through 2025, levelled off around March 2026, and is now edging back up in Netskope's customer mix. 30% of enterprise AI users still touch only personal AI applications; another 14% mix personal and managed tools.

The honest read is that enterprise AI risk is migrating from one surface to a neighboring one, and the migration is now moving faster than the surface it is leaving. The mental model worth carrying into the next quarter is simple. Stop asking only what is leaving. Start asking, on a named system, what the AI is bringing back. For teams that want a checklist, Netskope's MCP community explainer lays out the integration, investigation, and mitigation steps.