Most AI agents at companies sit unused but keep their logins
A security vendor's report says forgotten agents still hold working access to company systems, and nobody owns them.
Arrakis Security published its 2026 Autonomous Agents Threat Report on October 21. It looked at thousands of AI agents running in its customers’ systems over 12 weeks.
About 76% of enabled agents had not run in 60 days, and 44% had not run in 180 days. Their credentials still worked and their triggers could still fire.
- About 24% of the dormant agents could be started by an unsigned webhook from outside the company.
- Around 70% of agents connected to sensitive tools, and almost none of those links had verified data loss protection.
- Arrakis says most agents have no owner, so nobody switches them off.
The catch: Arrakis sells tools that scan and monitor agents, and the data comes from its own customers, not a neutral study. The report doesn’t say how many of these agents were ever actually misused.
What to do now
- List every agent, bot and automation you’ve connected to email, files or a CRM.
- Delete or pause the ones you no longer use, and revoke their logins.
- Give each remaining agent one named owner.
- Replace keys that never expire, and give each agent only the access its job needs.
Sources & links 2
More on AI Agent News, AI for Small Business, AI Safety & Regulation News