Akamai report finds 6% of enterprise chatbot sessions leak sensitive data

The transition from passive chatbots to autonomous agents requires a fundamental shift from identity management to real-time behavioral governance. As streaming platforms and media enterprises integrate AI to automate metadata tagging or dynamic ad insertion, the reliance on APIs increases the surface area for machine-to-machine exploits. This shift forces organizations to adopt Zero Trust architectures specifically for nonhuman identities to prevent unauthorized autonomous decisions. The broader ecosystem must now account for the speed of AI-driven vulnerability discovery, which threatens to outpace traditional software patching cycles. Watch for the adoption of graph neural networks to detect lateral movement and anomalous agent behavior across media supply chains.

Akamai has expanded its State of the Internet series beyond traditional DDoS and web security into agentic AI threat modeling. The company's Project Glasswing initiative, which focuses on securing machine-to-machine API interactions, represents a broader push to position Akamai as a governance layer for autonomous workflows running across CDN and edge infrastructure. This aligns with Akamai's existing role delivering content and APIs for streaming platforms, where agent-driven automation is increasingly common in metadata tagging, ad decisioning, and content packaging pipelines. Bitmovin's 2026/2027 Video Developer Report found that 98% of video professionals now use AI or ML in their workflows, with 46% employing AI tools daily, underscoring the scale of autonomous agent activity that security vendors like Akamai must now protect.

On the business and standards side, Akamai's report arrives as Anthropic's Model Context Protocol gains traction as a de facto interface for connecting AI agents to external tools and data sources. The protocol's rapid adoption means that enterprises deploying agentic workflows are increasingly standardizing on a shared integration layer, which concentrates both capability and risk. Akamai's recommendation of Zero Trust architecture for nonhuman identities reflects a broader industry recognition that traditional IAM frameworks were not designed for agents that autonomously chain API calls. Mux launched its Robots product in 2026, moving video AI analysis natively inside its platform, eliminating the need for developers to hold third-party API keys for moderation and summarization workflows. That architectural choice, keeping AI processing adjacent to the video asset rather than routing through external services, mirrors the principle Akamai advocates: reducing the attack surface by minimizing exposed credentials and inter-service hops.

From a competitive and technical standpoint, Akamai's findings intersect with how video delivery and CDN providers are evaluating AI-driven automation in their own stacks. MUBI selected Bitmovin's VOD Encoder in May 2026, migrating from legacy on-premises infrastructure to a managed cloud encoding service supporting multi-codec strategies including AVC, HEVC, and AV1. Cloud migrations of this type increase API surface area and introduce new machine-to-machine communication paths that fall squarely within the threat model Akamai describes. Meanwhile, independent analysis of encoding and OVP vendors notes that Bitmovin holds SOC 2 Type II and ISO 27001 certifications, while Mux's DRM integration typically requires pairing with separate providers like Vualto or EZDRM. These architectural differences in how video platforms handle credentials, key rotation, and third-party integrations directly affect the exposure risk that Akamai's report quantifies.