Oct 27, 2026

Article

When an employee quits, IT usually shuts off their access the same day. When an AI agent stops being used, new research suggests, nothing happens at all. It just sits there with its credentials live, waiting for someone to send it a request.

What the report found

Arrakis Security's 2026 Autonomous Agents Threat Report analyzed anonymized production data from thousands of AI agents running in its customers' environments over a 12-week period. These are agents that can read and write data, call tools and kick off workflows across business systems. The headline finding: 76% of enabled agents hadn't run in 60 days, and 44% hadn't run in 180 days. Their credentials still worked, and their triggers could still start them.

Arrakis CEO Tal Baron put the cause simply: in most companies, nobody owns an agent once people stop using it, so nobody removes anything.

The other findings are where it gets uncomfortable:

• About a quarter of dormant agents could be started by an unsigned webhook from outside the organization. In some cases, anyone who knows the URL can make the agent run.
• 22.9% of all agents had at least one unsecured trigger.
• 70% connected to at least one sensitive integration, such as cloud storage, AI services or marketing platforms. Of those, 99.4% had no verified data loss prevention on that connection.
• 19% used API keys or tokens that never expire, embedded in their configurations.
• 20% could hand a task to another agent with different permissions and get back results they aren't allowed to produce themselves.
• 82% carried at least one exposure, and 46% of those carried more than one.

Why a dormant agent is dangerous

Think of an agent as a contractor with a master key who stopped showing up but never handed the key back. If an attacker finds that agent's trigger, they don't need to steal credentials. They borrow the agent's. Everything the agent could reach, they can reach.

The delegation finding matters too. When one agent passes work to another, the first one receives output produced with the second agent's permissions, with no formal transfer of permission. That's privilege escalation built into the workflow design.

How much to trust the numbers

Read this with three caveats. First, Arrakis sells agent governance, so it benefits when the problem looks big. Second, the data comes from Arrakis customers, companies that already cared enough to buy agent security, not a random sample of all businesses. Third, some agents run on weekly, monthly or quarterly schedules, so "dormant" doesn't always mean abandoned.

Still, the direction matches what security leaders have warned about all year. AI agents are becoming a new kind of insider, with standing access and no manager.

What to do this week

1. Inventory every agent. Automations in your CRM, help desk and no-code tools count, including anything built in n8n or Zapier.
2. Give each one a named human owner. No owner, no credentials.
3. Expire credentials by default. Swap never-expiring keys for short-lived tokens, and revoke access for anything idle for 60 days unless it runs on a known schedule.
4. Lock down every trigger. Webhooks should verify who's calling and reject replayed requests.
5. Recertify agent access quarterly, the same way you review employee access.

The founders who win with agents won't be the ones who deploy the most. They'll be the ones who can still say what every agent is allowed to touch.