New research from Netskope Threat Labs has found that 83% of AI-related security alerts in manufacturing involve employees sharing information with AI tools in ways that breach company policies. This makes it the most prevalent AI-related security risk facing manufacturers, with employees potentially exposing confidential documents or sensitive company data through their use of AI applications.
Downstream data policy violations, where AI systems return information to users that are not supposed to see it, are making up an increasingly large proportion of AI security alerts at almost 10%. In light of this, manufacturing companies need to be able to monitor and inspect AI traffic in both upstream and downstream directions.
Regulated data, such as personal or financial information subject to legal protection, is the most common type of sensitive information involved in AI-related data policy violations, accounting for 57% of recorded events. Passwords and API keys follow at 19%, intellectual property at 16% and source code at 9%.
These incidents occur as AI adoption accelerates across manufacturing, with active AI use rising from 40% to 67% of employees in the sector over the past year. AI is also becoming part of everyday business applications, with 96% of employees using software containing AI-powered features and 90% interacting with systems that use customer or user data to train models.
While protecting sensitive information remains a challenge, manufacturers are making progress in bringing AI use under corporate control. The share of users adopting organisation-managed AI applications has doubled from 35% to 70% over the past year, while personal AI account use fell from 75% to 55%. However, the share of users switching between personal and enterprise accounts rose from 9% to 25%, suggesting that shadow AI remains a growing challenge, even as manufacturers gain greater control over AI use.
Beyond the applications employees use, manufacturers also need to consider how AI systems and agents connect with other systems. In manufacturing, the number of AI systems connecting to remote servers rose by 490% and the number of interactions increased by 600% between May and mid-August 2026 only. As AI becomes more integrated into everyday operations, manufacturers need to understand what information these tools can access and where it goes.
“Manufacturing organisations have moved well beyond initial trials with basic AI tools. We are seeing a clear transition toward deep operational integration, led by enterprise-managed solutions and developer platforms, alongside a sharp rise in automated MCP connections,” said Gianpietro Cutolo, Cloud Threat Researcher, Netskope. “While this adoption drives significant efficiency, it also introduces crucial security challenges around non-human entities and data governance that security teams must proactively address.”
Additional key findings include:
- Malicious AI lure activity increased from around 25 to around 100 users per 100,000 employees in February 2026, remained constant until May and then spiked further to nearly 175 per 100,000 in June.
- Interactions with malicious AI links appearing in responses served by AI applications began to rise in July 2025, reaching 150 per 100,000 users in October. A second increase began in February 2026, with activity climbing further to 200 per 100,000 users in March.
