Dormant agents keep their keys: two reports quantify the agent governance gap

Sourcing note: this report rests on two vendor research reports published on October 21, 2026, and on no independent verification. Arrakis Security's figures come from its own telemetry across its customers' production agents, and Illumio's figures come from a survey conducted for Illumio by Sapio Research. Each figure below is the publishing firm's own and is stated as such. This item will be updated when independent data on agent governance appears.

Arrakis Security's 2026 Autonomous Agents Threat Report, based on 12 weeks of anonymised production telemetry from thousands of AI agents, found that 76 percent of active agents have not run in 60 days, and 44 percent have not run in 180 days, while their credentials still work and their triggers still fire. It found that 24 percent of dormant agents can be started by an unsigned webhook from outside the organisation, 70 percent can reach sensitive systems, and 20 percent can pass a task to another agent with different permissions and get back results they are not themselves allowed to produce. Illumio's report the same day, from a Sapio Research survey of 1,100 IT and security decision makers across 10 markets, found that 70 percent of organisations now delegate decisions that required human approval a year ago, yet only 49 percent can see and audit every action an AI agent takes, and 76 percent had at least one AI related security issue in the past 12 months.

Sources: HackRead; GlobeNewswire