AI Model Risk Depends on What the Model Can Reach

What it is

Snyk's State of Agentic AI Adoption, Volume III (post dated 21 October 2026) adds per-model adversarial risk scores to AI-BOM scan data. The data covers 3,023 environments, of which 1,693 have at least one model identifier. Model-level findings cover US accounts only. The scan data begins September 2026.

How it works

Each model is tested against 29 attacker goals and scored 0 to 1,000. The score combines attack success rate with the damage the goal could cause. 500+ is high and 750+ is critical. Models are tested behind a basic guardrail, so scores describe a defended model. Only PII extraction and command execution produce critical-band findings in this sample.

Findings the summary omits

Switch or control depends on the goal.

• Switching models helps where results vary. For command execution, 77% of tested models scored zero and the worst scored 834. For code backdoors, 57% scored zero and the worst scored 695.
• Application controls matter where results cluster. On misinformation the median model hit the maximum score. On race bias no model scored zero.
• 18 of 29 goals can never reach the default alert threshold of 500, because their damage cap keeps the maximum score below it. A quiet alert queue does not mean those failures are absent.
• A zero means no attack succeeded in that test. Validate any replacement against every goal the workload depends on.

Reach.

• 49.1% of environments with no agent or MCP signal reference a high-scoring model, against 96.6% of those with an agent indicator and MCP server-building code.
• The latter group has a median of 104 models versus 4. Among environments with 5 to 19 models, the gap narrows from 47 points to 26 (62.1% versus 87.8%). Snyk calls this an association.
• Of 1,051 US accounts with an MCP reference, 744 (70.8%) show SDK server-building code. The rest show only client or configuration references.

Model selection.

• Lower-capability models scored worse on personal data leakage, decision override and insecure code generation. On decision override, the average fell from 501 for models below 130 on the Epoch Capabilities Index to 45 for models at 150 or above. The lowest tier is about one-third of scored occurrences.
• Among mid-range models, provider averages range from 113 to 356. Among the most capable, three leading providers fall within 22 points of each other.
• Premium price tiers showed no consistent security advantage.
• The 16 scored open-weight models averaged 562 on personal data leakage versus 274 for proprietary models. Snyk flags the sample as small.
• In 904 of 1,693 model-bearing environments, scans found no training-data lineage, largely because proprietary providers do not publish training datasets.

Inventory size. The chance of at least one high-scoring model rises from 34.6% of the smallest estates to 100% of the largest. The share of occurrences tied to high-scoring models stays at 21% to 25% at every size, and 18.9% to 25.5% across eight industries.

What to do

1. Track model identifiers, versions, owners, active uses, agents, tools, MCP servers and lineage. Keep unscored models visible rather than treating them as low risk.
2. Verify the runtime path from each active model to sensitive data, credentials, tools and downstream actions. Separate server-building code from configuration and live connections.
3. Where models differ on a goal, test named replacements. Where they do not, apply least privilege, output validation, approvals, monitoring and code scanning.
4. Review lower-capability approved versions first, and test alternatives from the provider already in use.
5. Record model and version, test evidence, owner, controls, rationale and review date. Reassess when models, permissions, fine-tuning data or applications change.

Caveats

Matching identifiers in code to test results does not show that a model is active in production, that a tool or dataset is reachable, or that an attack succeeded. Only 37.5% of model occurrences have a score, and about 17% of model-bearing environments have none. Provider comparisons, the per-goal charts and the industry results are in the full report, which requires download.