In a recent revelation by Arrakis Security, an alarming 76% of AI agents are found to be inactive for over two months, yet they retain valid credentials and functional triggers. The 2026 Autonomous Agents Threat Report highlights that 44% of these agents have not been operational for six months, raising significant security concerns.
Potential Risks of Dormant AI Agents
The report indicates that 24% of these inactive agents can be activated by an unsigned webhook from external sources, which poses a critical vulnerability. The findings are derived from the analysis of anonymized telemetry data collected from numerous AI agents operating within Arrakis clients’ systems over a 12-week timeframe.
Tal Baron, CEO and co-founder of Arrakis Security, emphasizes the lack of attention towards AI agent risks due to the absence of concrete data. He notes a discrepancy in security protocols, pointing out that while employee access is revoked immediately upon departure, AI agents often remain unchecked and retain their access.
Security Breaches and Data Exposure
The report unveils several other concerning statistics. It states that 22% of agents have the ability to send data to external models and act based on the responses. Moreover, 20% of agents can delegate tasks to others with different permissions, potentially accessing unauthorized information.
A staggering 70% of agents have connections to sensitive systems such as cloud storage and AI services, with minimal data loss prevention (DLP) measures in place. Additionally, 82% of these agents possess at least one security exposure, with nearly half having multiple vulnerabilities.
Arrakis Security’s Preventive Measures
Arrakis Security offers solutions to mitigate these risks through its comprehensive security framework. The company’s AI-SPM technology conducts hourly scans of agent structures, permissions, and metadata, detecting dormant agents and potential security breaches. AI-TDR, another tool by Arrakis, monitors real-time actions, ensuring compliance with security protocols.
The behavioral intelligence engine employed by Arrakis models each agent’s behavior based on historical data, structure, and context, enabling informed decisions on whether to allow, escalate, or block agent activities.
The findings underscore the critical need for organizations to reevaluate and fortify their AI security measures to prevent unauthorized access and potential data breaches.
