Cisco's 2026 WAN study says agentic AI will push enterprise traffic from 2.5x to 9x by 2035, with AI inference flows making up 25% of all traffic and lasting 2x longer than web flows. Google Cloud's COO publicly disclosed that attack chains now move from breach to handoff in 22 seconds and that a single Maps API key silently gained Gemini access and drained $10,138 in 30 minutes. Credential brokering is the new minimum for least privilege.

WANs Under Pressure, Security Plays Catch-Up, Least Privil

Three forces are reshaping the network and security stack in 2026, and they are colliding. Cisco's new WAN study says agentic AI is going to push enterprise traffic growth from 2.5x to 9x by 2035. Google's security team is openly admitting that agentic AI is exposing "old SharePoint servers and forgotten data nobody knew existed" while developers are getting five-figure API bills from keys that silently gained Gemini access. And the credential-brokering pattern — agents holding user OAuth tokens, agents with overly broad scopes — is forcing a "least privilege" reset across every AI agent deployment that touches production.

What You Need to Know: Cisco's "AI Impact on Wide Area Networks 2026" study projects that without agentic AI, enterprise network traffic grows 2.5x by 2035; with agentic AI, that jumps to 9x. AI inference flows last 2x longer than regular web transactions, with median flow rate 10x lower, and by 2035 roughly 25% of network traffic will be AI inference. Google's Cloud COO has publicly disclosed that the attack chain from breach to handoff has collapsed from 8 hours to 22 seconds, and that Google developers got hit with $10,138 in 30 minutes from a single Maps API key that silently gained Gemini access. The credential-brokering pattern — agents inheriting full user OAuth tokens — is the dominant control failure the industry is now scrambling to fix.

Why It Matters

If your network capacity plan was built around a 2.5x growth assumption, it is already wrong. 9x is the new planning baseline, and the inflection is 2029–2032.
"AI inference flows" are a new traffic class. They last longer, run at lower rates, and have asymmetric security requirements. Quality-of-service and path security are now first-class design problems, not afterthoughts.
The Google disclosure is the most important security story of the week. A single Maps API key silently gained Gemini access. Five-figure bills in 30 minutes. This is the control plane failure pattern of 2026.
Credential brokering is the architectural answer. The agent gets scoped credentials, not the user's full token. This is not a feature request — it is the new minimum.
If your "least privilege" audit has not been redone since you started shipping agents, you do not have least privilege. You have a tickbox.

What Actually Happened

Cisco's WAN Study: 9x Traffic, New Flow Shape

Cisco's "AI Impact on Wide Area Networks 2026" combines real-world traffic analysis (via the Crosswork Assurance User Experience service), third-party industry data and Cisco-controlled lab tests. The headline: without agentic AI, enterprise network traffic is projected to grow 2.5x by 2035. With agentic AI adoption, that figure jumps to 9x. (Network World, Cisco report PDF)

The flow-shape findings matter more than the volume number. AI inference flows last 2x longer than regular web transactions, because the model generates output one token at a time, producing longer, lower-rate flows. Median flow rate is 10x larger for regular web transactions than for AI inference. For "flow-aware" network systems that must keep state for flows in tables, the proliferation of AI inference flows means growing flow tables that need to be effectively planned, and over time, security and flow-aware systems are likely to become more distributed. Cisco also projects that by 2035, roughly 25% of all network traffic will be AI inference, with token-consumption data showing nearly 10x year-over-year growth and some service-provider measurements showing 4x growth in just eight months. (Network World)

The study quotes Cisco's Javier Antich and Guru Shenoy: "If AI models are the 'brains' of this new era, then networks are the nervous system, and when autonomous agents begin to act, decide, and transact on behalf of humans at scale and machine speed, that nervous system of connectivity must be ready." Gartner's companion forecast, cited in the study, says 40% of enterprise applications will include integrated, task-specific AI agents by 2026, up from less than 5% in 2025, and that by 2035, agentic AI will drive approximately 30% of all enterprise application software revenue, exceeding $450 billion globally.

Google Security: The 22-Second Attack Chain

TechCrunch's interview with Google Cloud COO Francis de Souza, headlined "Everyone is navigating AI security in real time — even Google," is the most candid public admission of the control-plane failure pattern. The numbers: attack chains now move from breach to handoff in 22 seconds, down from 8 hours. The risk pattern: "AI agents will expose old SharePoint servers and forgotten data nobody knew existed." The cost pattern: Google developers got hit with five-figure bills after API keys for Maps silently gained Gemini access. One specific incident drained $10,138 in 30 minutes from a single account. (TechCrunch)

The de Souza framing is "platform-level security from day one." The implicit admission is that the pre-agent security model — keys with broad scopes, OAuth inheritance, default-on API access — is the failure mode, and the agent layer exposes it at machine speed. The fix is not a feature; it is an architecture: scoped, identity-bound, audit-logged credentials for every agent action.

Credential Brokering for AI Agents

Infisical's "Credential Brokering for AI Agents, Explained" is the most-cited technical write-up of the pattern. The core problem: agents need API keys and tokens to work, but prompt injection and malicious content can trick them into leaking environment variables or credentials. The architectural fix is a private proxy — a "credential broker" — that holds the real secrets, attaches them to outbound HTTPS requests, and keeps raw values away from the agent. (Infisical)

The reference implementation, Agent Vault, runs the broker on a separate host, pulls secrets from a central store, authenticates agents, swaps placeholders for real tokens, and enforces isolation plus low-latency co-location so agents can hit targets like GitHub without ever seeing the underlying keys. This is the "least privilege" implementation that matches the threat model. The WorkOS pitch from the TLDR InfoSec digest runs the same architectural play from the OAuth side: agents get their own identity, scoped credentials and permission boundaries, with audit logs tied to every agent, every action, every authorization.

The TLDR InfoSec Catch-Up

The TLDR InfoSec digest this week (Cisco CVSS 10 patched, RondoDox botnet, Ubiquiti UniFi OS flaws, Ghost CMS SQL injection exploited at scale, the Netherlands seizing 800 servers of a hosting firm enabling cyberattacks) is the operational evidence that the security stack is playing catch-up. Each item is a different control failure, and each one was made worse by the speed of agentic exploitation. The Netherlands takedown of THE.Hosting / WorkTitans B.V. (linked to EU-sanctioned Stark Industries) is the most visible example of the bulletproof-hosting model breaking under sanctions enforcement. (BleepingComputer)

The Take

The Cisco study is the one to read carefully, and the reason is that 2.5x vs 9x is not a 3.6x capacity-planning tweak. It is a fundamental redesign. The flows are longer, the rates are lower, the symmetry is different, and the criticality is higher. If your network team is still planning around "video-heavy web traffic," they are planning around 2018.

The Google admission is the part that should keep you up at night. A single Maps API key silently gained Gemini access. Twenty-two seconds from breach to handoff. This is not a sophisticated APT — this is the default behaviour of an unscoped credential plus an agent. The credential-brokering pattern is the right answer, and the right answer is now table stakes for any agent touching production.

Least privilege in 2026 is not a quarterly review. It is a runtime invariant enforced by a broker. If your agent's request to your database is using the same token as the user logged into the dashboard, that is not least privilege. That is a breach waiting for an injection.

Quick Summary

Cisco's 2026 WAN study says agentic AI will push enterprise traffic from 2.5x to 9x by 2035, with AI inference flows making up 25% of all traffic and lasting 2x longer than web flows. Google Cloud's COO publicly disclosed that attack chains now move from breach to handoff in 22 seconds and that a single Maps API key silently gained Gemini access and drained $10,138 in 30 minutes. The architectural answer is credential brokering — scoped, identity-bound credentials for every agent — and the security stack is playing catch-up.

WANs Under Pressure , Security Plays Catch-Up , Least Privil