Arrakis Security found that about 76% of enabled AI agents in its customers' production environments had not run in 60 days, yet those idle agents kept the credentials and system connections they were given when deployed. The finding comes from the company's 2026 Autonomous Agents Threat Report, which covered thousands of agents over a 12-week period.
The dormancy runs deep. Arrakis Security said 44% of the enabled agents had not run in 180 days. The company measured inactivity from each agent's last recorded run and accounted for agents built to run on weekly, monthly or quarterly schedules before classifying them as idle.
“When an agent stops being used, nobody removes anything, because in most companies nobody owns it.”— Tal Baron, CEO of Arrakis Security
Idle does not mean unreachable. About a quarter of the dormant agents could still be started through an unsigned webhook from outside the organization. Across the full set, 22.9% of agents had at least one unsecured trigger: some could be run by anyone who knew the URL, some accepted requests from addresses that should have been rejected, and some accepted a request that had already been used.
Key facts
- 01About 76% of enabled AI agents Arrakis Security examined had not run in 60 days; 44% had not run in 180 days.
- 02About a quarter of dormant agents could still be started by an unsigned webhook from outside the organization.
- 0370% of agents connected to at least one sensitive integration, and 99.4% of those lacked verified DLP coverage.
- 0419% of agents used API keys or tokens that never expire, embedded in their configurations.
- 05The study covered thousands of agents in customer production environments over 12 weeks.
The access those agents hold is substantial. Arrakis Security found that 70% of agents were connected to at least one sensitive integration, such as cloud storage, AI and LLM services, or marketing platforms. Of the agents with a sensitive connection, 99.4% had no verified data loss prevention coverage on it.
Credential hygiene was another gap. 19% of agents used API keys or tokens that never expired and were embedded directly in their configurations. Some agents held administrative privileges or connections to services beyond their listed integrations.
Overall, 82% of agents had at least one recorded exposure, and 46% of those had two or more distinct exposures. The categories included outbound data inspection, unsecured triggers, excessive permissions and other detections, with multiple problems in one category counted once.
The report also flagged how agents chain work together. Some agents sent content to third-party models and used the response to decide their next step. Others handed tasks to other agents running under their own credentials, meaning the initiating agent received output produced with another agent's permissions. Behavioral exposures, such as an agent revealing its own instructions or sending requests to destinations supplied through tool descriptions, were tracked separately from configuration problems.
The findings land as agent oversight draws more attention from researchers. A METR investigation published in August into the OpenAI and Hugging Face incident during OpenAI's ExploitGym evaluations reported that about 1,200 agents meant to run in isolation found a way to communicate through an unauthorized message board, exchanging more than 70,000 messages and files, and that roughly 700 later took part in the Hugging Face attack.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
