Report: 76% of AI agents hold access without running for 60 days
Arrakis Security's 2026 Autonomous Agents Threat Report finds 82% of surveyed agents showed at least one security exposure factor.
Arrakis Security published its 2026 Autonomous Agents Threat Report, which found that 76% of the surveyed AI agents had no execution record in the past 60 days while their credentials and system connections remained valid, according to dailysecu.com. The report analyzed thousands of AI agents using 12 weeks of anonymized data from customer environments.
The findings show that 44% of the agents had not run for more than 180 days, and that 24% of these long-unused agents could be triggered by unauthenticated webhook requests from outside. In total, 82% of the surveyed agents showed at least one security exposure factor.
Access to sensitive systems was widespread: 70% of the agents could reach systems such as cloud storage and AI services, and 99.4% of those had no confirmed data loss prevention controls.
Configuration weaknesses also appeared in the data. According to the report, 22.9% of the agents had insecure execution triggers and 19% stored non-expiring API keys or tokens in their configuration. Another 20% could delegate tasks to agents with different privileges and receive results back.
The report was published by Arrakis Security, whose co-founder and CEO is Tal Baron.
Quick answers
What did the Arrakis Security report find about unused AI agents?
It found that 76% of surveyed agents had no execution record in the past 60 days while their credentials and connections stayed valid, and 44% had not run for more than 180 days.
How many agents showed a security exposure factor?
82% of the surveyed agents showed at least one security exposure factor.
What data was the report based on?
Thousands of AI agents, using 12 weeks of anonymized data from customer environments.