A new threat report built from real production telemetry is putting hard numbers behind something security teams have suspected for a while: once an AI agent is deployed, almost nobody goes back to check whether it’s still being used — or whether it should still have the access it was given on day one.

The data behind the warning

The 2026 Autonomous Agents Threat Report, published by Arrakis Security, is based on anonymized telemetry gathered over a 12-week period from thousands of AI agents running inside the company’s customer environments. The headline figures paint a picture of sprawling, unmanaged agent infrastructure:

• 76% of active agents have not executed a single run in the past 60 days
• 44% have been inactive for 180 days or longer
• 24% of these dormant agents can still be triggered by an unsigned webhook originating from outside the organization

In other words, a large share of the AI agents sitting in enterprise environments today are effectively abandoned — but their credentials, API connections, and automated triggers were never revoked, and in many cases can still be fired remotely by anyone who finds the right endpoint.

Why dormant doesn’t mean harmless

Tal Baron, CEO and co-founder of Arrakis Security, framed the core problem as a gap in ownership rather than a technology failure. “When an employee leaves, their access is removed the same day,” Baron said. “When an agent stops being used, nobody removes anything, because in most companies nobody owns it.”

That lack of ownership shows up across several other findings in the report that go beyond simple dormancy:

• 22% of agents can send content to a third-party model and act on whatever response comes back, effectively letting an external system influence the agent’s behavior
• 20% of agents can delegate a task to a second agent with different — often broader — permissions, and receive results back that the original agent wasn’t allowed to produce on its own
• 70% of agents have reach into sensitive systems such as cloud storage, AI service providers, and marketing platforms, and almost none of those connections are covered by verified data loss prevention controls

Taken together, Arrakis found that 82% of the agents it analyzed carry at least one meaningful exposure, and nearly half of those carry more than one simultaneously — a stacking effect that multiplies risk rather than isolating it.

The permission-delegation problem

The agent-to-agent delegation finding is worth dwelling on, since it echoes a familiar privilege-escalation pattern from traditional IT security, just transplanted into agentic workflows. If Agent A cannot directly query a sensitive database but can ask Agent B — which has that access — to run the query and hand back the result, then Agent A’s effective permissions are broader than its assigned permissions on paper. Traditional identity and access management tooling, built around human users and service accounts, often has no visibility into this kind of indirect access chain at all.

What organizations are being told to do

The report’s practical recommendations track closely with how mature organizations already handle human offboarding and stale service accounts, applied to agents instead:

• Inventory every deployed agent, including ones nobody remembers building, and assign a human owner to each
• Automatically flag or disable agents that haven’t run within a defined window, rather than letting dormant credentials linger indefinitely
• Audit which external systems and webhooks can trigger an agent, and remove unsigned or unauthenticated entry points
• Treat agent-to-agent task delegation as a privilege boundary that needs its own monitoring, not an internal implementation detail
• Apply data loss prevention controls to agent connections reaching cloud storage, AI platforms, and marketing systems, the same way those controls are applied to human accounts

Arrakis positions its own platform — built around hourly scanning of agent structure and permissions plus real-time behavioral monitoring — as one way to close this gap, but the underlying lesson doesn’t depend on any particular vendor. As organizations rush to deploy AI agents across customer service, coding, data analysis, and internal automation, the report is a reminder that an agent is a credentialed identity with system access, and it needs the same lifecycle discipline — provisioning, monitoring, and deprovisioning — that security teams already apply to human accounts and service accounts. Skipping that step doesn’t make the risk disappear; it just makes it invisible until something goes wrong.