Arrakis Security Report Finds 76% of AI Agents Are Dormant but Keep Their Credentials and Connections
CyberNewswire
Posted On October 21, 2026
New York, NY, USA, October 21st, 2026, CyberNewswire
According to the 2026 Autonomous Agents Threat Report, published by Arrakis Security, 76% of active agents have not run in 60 days, but their credentials still work and their triggers still fire. 44% have not run in 180 days. 24% of dormant agents can be started by an unsigned webhook from outside the organization.
The report is based on anonymized, unidentifiable production telemetry from thousands of AI agents in Arrakis customers’ environments, collected over a 12-week period.
“There’s a lot of discussion about AI agent risk, and very little data”, said Tal Baron, CEO and co-founder of Arrakis Security. “When an employee leaves, their access is removed the same day. When an agent stops being used, nobody removes anything, because in most companies nobody owns it”.
Other findings:
- 22% of agents can send content to a model run by a third party and act on the answer.
- 20% of agents can pass a task to another agent with different permissions, and get back results they aren’t allowed to produce themselves.
- 70% of agents can reach sensitive systems, such as cloud storage, AI services, and marketing platforms, and almost none of those connections have verified data loss prevention (DLP).
- 82% of agents carry at least one exposure, and 46% of those carry more than one.
The full report is available at https://arrakis.security/2026-threat-report.
About Arrakis Security
Arrakis secures autonomous agents through behavioral intelligence across three layers: what an agent is, what it does, and why. AI-SPM scans each agent’s structure, permissions, tools, and metadata hourly, including agents that never run, surfacing shadow agents, exposed keys, and misconfigurations. AI-TDR monitors actions in real time for deviations from defined rules and policies. The behavioral intelligence engine models each agent from its own history, posture, runtime, and context: how it got there and what it could do next. For each action, it decides whether to continue, escalate, or intervene.
Contact
Moranne Shechnick
Arrakis Security
[email protected]
