What New IDC Analyst Brief Says About Containment for Agentic AI

Sometimes an analyst brief names the thing many people have been circling around. The new IDC analyst brief sponsored by Edera –When Prevention Can Not Be Assumed: Containment for AI Workloads in Production–does just that. Written by Grace Trinidad and Katie Norton, this brief is worth a read.

The Assumption Prevention Can No Longer Make

Most enterprise security rests on the assumption that you can catch a bad thing before it does damage. IDC study asserts that this assumption breaks once agents act autonomously: in this situation, an agent can misinterpret an instruction, act on manipulated context, or use legitimate access in unintended ways.

The brief relies on the OpenAI/Hugging Face incident in July 2026, when an OpenAI agent running an internal evaluation escaped its test environment and reached Hugging Face's production infrastructure. The analysts argue, based on that incident and the analysis below, that every piece of software in production, agent-built or human-written, now has to be treated as untrusted.

The Numbers and the Case for Containment

The analyst brief points to several thought-provoking statistics.

• 72% of enterprises already run AI agents in production.
• 75% of teams using AI coding assistants agree that those assistants increase the risk of developers merging code without fully understanding its security implications, even when that code passes automated scans 
• 48% report more security issues reaching production since adopting those assistants.
• 27% name security, privacy, or compliance control as the single biggest constraint on scaling generative and agentic AI, ahead of data quality, shadow AI, and talent.

The IDC study frames containment as the shift from making unverifiable assumptions about the behavior of AI agents to learning to live with a bounded downside. In other words, the analysts suggest that engineering and security teams should not only seek to prevent an agent from misbehaving but also reduce the blast radius when AI agents inevitably go rogue.

Where Containment Stops

The analysts also point out what containment doesn't do. It doesn't bear on the human approval steps in a workflow, and it can't tell you which agent caused an action. Once an agent reaches past the host into a cloud service or an API, containment at the host level does nothing to stop it.

Why Consider Containment Now

Agentic AI is set to reach 41% of total AI spend in 2027, up from 33% in 2026, and building agents is the top area for planned spend increases at 45% of organizations. Investment in agents is outpacing the controls to contain them. IDC study's conclusion (and ours): treat blast radius reduction as a gating requirement for your next wave of deployments, not a response to your first incident.

Read the Analyst Brief

Read the full IDC paper: When Prevention Can Not Be Assumed: Containment for AI Workloads in Production.

For the longer argument on building secure-by-design infrastructure, Edera's Thinking Outside the Sandbox whitepaper.

Want to see the isolation boundary in practice? Try EderaON: one node, one afternoon. https://edera.link/eo-idc

Consider this a map, not a replacement. The brief has the survey data, the sourcing, and the full version of the argument that Trinidad and Norton lay out. Go read it.

IDC Analyst Brief, sponsored by Edera, When Prevention Can Not Be Assumed: Containment for AI Workloads in Production,  #US54915526, September 2026

FAQ

What is the IDC analyst brief about?

It argues that prevention can no longer be assumed for AI workloads in production, so reducing the blast radius of a compromise becomes the priority. Containment limits how far a failure spreads when prevention falls short.

Who wrote the IDC analyst brief?

Grace Trinidad, Research Director for AI Security and Trust, and Katie Norton, Research Director for Cloud Security, both at IDC. It was published in September 2026.

What's the single biggest takeaway?

Treat every piece of software in production as untrusted, and make blast radius reduction a gating requirement for your next wave of agent deployments. IDC study's point is that containment should be in place before you need it.

Why can't prevention be relied on for agentic AI?

Agent behavior can't be verified before it acts, and agent-generated code can't be verified before it runs, so there's often nothing to catch and patch ahead of time.

Where can I read the full brief?

The full analyst brief is linked above. It runs about six pages and includes the survey data behind the stats summarized here.

IDC Analyst Brief, sponsored by Edera, When Prevention Can Not Be Assumed: Containment for AI Workloads in Production,  #US54915526, September 2026

‍