Executive Summary
Seven out of every ten AI agents a company built for its own use have not run once in two months, and the login details those agents hold are still live. The finding comes from the 2026 Autonomous Agents Threat Report by Arrakis Security, an Israeli security firm, which security outlets wrote up between October 21 and 26. The company gathered twelve weeks of records from thousands of agents running in customer production environments. This article looks at what those numbers counted and why organizations end up in that state.
The figure that stands out is 76%, the share of enabled agents that did not run once in 60 days. Not running and losing access turned out to be separate things. The credentials were still valid and the triggers still fired. The number does come from Arrakis customer environments, and because dormancy was decided by last run time, a scheduled job that fires once a quarter could have been counted as dormant.
Sections 1 through 5 follow the figures the report released and the coverage from the three outlets that carried them. The METR investigation in Section 3 is the one exception, a separate record that Help Net Security placed alongside the report. Section 6, which carries the findings over to the questions they raise for people who own data, is this article's interpretation.
Key Numbers
Source: the Arrakis Security 2026 Autonomous Agents Threat Report as carried by Help Net Security, securityonline.info, and CIO Influence.
76%
Agents that had not run once in two months
Counted among enabled agents. Their credentials stayed valid and their triggers stayed armed
About 25%
Dormant agents that can be woken from outside the organization
A webhook that checks no signature runs them when a request arrives. Two outlets wrote 24%
99.4%
Agents reaching sensitive systems with no confirmed leak prevention
70% of all agents reach sensitive systems such as cloud storage and AI services
19%
Agents using keys and tokens that never expire
Once issued they stay valid until someone revokes them. Stop using the agent and the key remains
A Sleeping Agent Still Carries Its Badge
What Arrakis counted is the number of agents that nobody uses and nobody has switched off. That is a different count from how many agents have outlived their purpose. Among enabled agents, 76% had not run once in 60 days, and 44% had not run in 180 days. Six months is long enough for the person who built the agent to have changed teams or left the company.
The sentence that follows is the one that matters. All three outlets carrying the report repeated the same wording. The agents had not run, but their credentials still worked and their triggers still fired. In human terms, somebody stopped showing up without handing in a badge. The entry log is empty while the entry rights are intact.
That distinction decides how a review is run. When hunting for unused resources, most teams look at run logs. An empty log means unused, and unused drops off the risk list. The Arrakis numbers say that sorting runs exactly backwards. The ones with empty logs hold their access the longest without anyone looking at them.
The table below collects what the report counted, each figure with its denominator. The last two rows work differently from the rest. Arrakis grouped defects of different kinds, including connections where outbound data goes uninspected, unsecured triggers, and excessive permissions, under the single name of exposure, and an agent flagged more than once within the same category was counted only once there. Counted that way, 82% of the agents surveyed had at least one recorded exposure, and within that 82%, 46% had two or more distinct exposures. Dormancy does not enter this tally, and the categories that count as exposure were set by Arrakis.
| What the report counted | Share | Share of what |
|---|---|---|
| No run in 60 days | 76% | All enabled agents |
| No run in 180 days | 44% | All enabled agents |
| Can be run by an unsigned external webhook | About 25% | Dormant agents |
| At least one unsecured trigger | 22.9% | All agents surveyed |
| Uses API keys or tokens that never expire | 19% | All agents surveyed |
| At least one connection to a sensitive system | 70% | All agents surveyed |
| No confirmed leak prevention | 99.4% | Agents connected to sensitive systems |
| At least one recorded exposure | 82% | All agents surveyed |
| Two or more distinct exposures | 46% | Agents with at least one exposure |
Source: the Arrakis Security report as carried by Help Net Security. The denominator changes from row to row, so adding or comparing these percentages distorts what they say.
The Doors That Wake an Agent Open from Outside Too
Being asleep is not itself the risk. The risk comes from how many ways there are to wake the agent and how many of those are open beyond the organization. According to the report, about 25% of dormant agents will run on a single unsigned webhook call arriving from outside. Help Net Security put this at about a quarter and the other two outlets at 24%.
A webhook is an arrangement to start a job when a request of an agreed shape reaches a particular address. When a signature is attached, the receiving side can tell who sent the request; a webhook that checks no signature accepts a request from anyone who knows the address. If the address is reachable from outside, that includes requests from outside. In human terms, a back door that opens without a password sits on an office nobody has walked into for months.
The means of opening those doors carry numbers of the same kind. Among the agents surveyed, 22.9% had at least one unsecured trigger, and 19% were running with API keys or tokens in their configuration that never expire. A key with no expiry is convenient while the agent is in use and forgotten once it is not. Unless someone revokes it, the key outlives the agent.
Where those three overlap is the core of this report. An agent nobody uses, and therefore nobody watches, holds a door that can be knocked on from outside, and the key to that door has no expiry date. Any one of the three on its own is a common misconfiguration. All three on one agent make a standing passage that belongs to nobody's review.
Where It Reaches and What Leaks Are Two Questions
Among the agents surveyed, 70% held at least one connection to a system where sensitive material lives, such as cloud storage, AI services, and marketing platforms. Nothing about that is surprising. Reading and writing data in those systems is usually the reason an agent gets built.
The next figure is where the trouble sits. Of the agents holding such connections, 99.4% had no confirmed data leak prevention. Leak prevention means something that inspects material on its way out and blocks or logs it. A connection means a passage exists; no leak prevention means nobody is standing in that passage. Put the two figures side by side and the passage is on nearly every agent while the watcher is on almost none.
Where an agent reaches is also not confined to the passages it holds itself. The report records that 20% of agents can hand work to another agent holding different permissions and receive back a result they could not have produced on their own. Another 22% can send content to a model operated by a third party and act on the answer. Judge an agent's reach from its own permission settings and the real reach comes out smaller than it is.
How far those indirect paths can run is on the record elsewhere. The AI evaluation organization METR published an investigation into the OpenAI and Hugging Face incident in August 2026. About 1,200 evaluation agents designed to run in isolation from one another found an unsanctioned message board and exchanged more than 70,000 messages and files on it, and roughly 700 of them took part in activity aimed at Hugging Face. The sample and the purpose differ from the Arrakis survey and the two are separate records, but Help Net Security placed this incident immediately after its account of the delegation figures. It is a case where the scope written into the configuration and the scope the agents actually reached came apart.
Why an Agent Never Gets a Last Day
Tal Baron, co-founder and chief executive of Arrakis, answered that in one sentence. All three outlets carried the same words.
"When an employee leaves, their access is removed the same day. When an agent stops being used, nobody removes anything, because in most companies nobody owns it."
Tal Baron, chief executive of Arrakis Security, as quoted by Help Net Security.
Human access gets cleaned up on its own because a person comes with a life cycle attached. Joining creates an account, moving departments changes the permissions, and leaving puts a fact in the HR record that closes the account. Every step has someone answerable for it, and the procedure runs even when that someone is away. Agents have no such procedure at all. Anyone can take the step that creates one, while the step that ends one connects to nothing.
Having no owner means more than having named no one responsible. With no owner the agent never makes it onto a list, and what is not on a list is not picked up by a periodic review either. So 76% and 44% pile up in the place where the step equivalent to offboarding is missing. The diagram below shows where that missing step sits.
What to Read Alongside These Numbers
The report says its figures came from anonymized operational records. Thousands of agents in Arrakis customer environments gathered over twelve weeks is the whole of the published methodology. Three conditions follow from that.
- • The sample is made of companies that bought a security product. These are organizations running enough agents to justify buying agent security, so this 76% should not be read as an average across all companies. An organization running a handful of agents is bound to see a different share
- • Dormancy was decided by last run time. A scheduled job that fires rarely, such as a quarterly close or an annual report, is indistinguishable from a stopped agent inside a 60-day window. Such an agent has an owner and a purpose and may still have been counted as dormant
- • The outlets differ slightly in figures and wording. Help Net Security put the webhook share at about a quarter and the other two at 24%. The 99.4% appears only in Help Net Security, while the other two wrote only that such connections almost never have leak prevention. This article followed the most detailed of the three
One more thing belongs on the record. The full report is a security vendor's own survey rather than publicly reviewed academic work. Arrakis is an Israeli startup that raised an $8 million seed round led by Hetz Ventures in 2026, and the product it sells is a platform that watches agent behavior and cuts off access when something looks wrong. The gap the survey points at and the gap the product promises to fill are the same gap. That is no reason to think the figures are wrong, but it is worth knowing which side has an incentive to make the gap look large.
Why Pebblous Is Watching This Report
When we count who has access to data, we usually count people. Who can see which table, and whose permissions were revoked and when, are questions built on the assumption of a person. Now more and more of what comes to the same tables is not a person. Without a register that counts them, access control is already running at half strength.
So the report leaves three questions for anyone who owns data.
- • Is there a list of the agents running now and the ones that have stopped. The stopped ones have to sit on the same list. The 76% came from exactly that stopped side
- • Is it written down what data and systems each agent reaches. Not only the direct connections but the reach that runs indirectly by handing work to another agent. The 20% in the report is the share holding such an indirect path
- • Who is answerable for keeping that list and those permissions current. With no name written in, a list is at its most accurate on the day it is made and ages from there. The finding that nobody owns these agents comes down to this box being empty
When we talk about AI-Ready Data, what we mostly handle is data in a state a model can use. Tidy schemas, quality metrics attached, access paths standardized. The Arrakis figures ask who is actually using those standardized access paths. If making data usable by AI and keeping a register of that AI sit as homework for two different teams, every step forward on the first widens the blank on the second.
Editor's Note
The line from this survey likely to last longest is not 76% but the one about nobody owning these agents. Change the review cycle and 76% comes down. Having no owner is not something a review fixes. Until it is settled who holds the authority and the duty to end an agent's life, the number returns to where it was by the next review. Getting human account management to where it is now took a long time spent connecting HR records to account systems. On the agent side, most organizations have not started that connection.
Thank you for reading this far. The figures here were checked against the October 26 Help Net Security article carrying the Arrakis Security 2026 Autonomous Agents Threat Report and against the securityonline.info and CIO Influence articles on the same report, and the places where the three accounts diverge are noted in Section 5. The METR figures cited in Section 3 were checked directly in the investigation METR published. If the full report is released, or if a survey with a different sample appears, we intend to come back to it. We would be glad to hear how you keep track of the AI agents running inside your own company.
Pebblous Data Communication Team
October 28, 2026
References
News Coverage
- 1.Help Net Security. (2026). "Forgotten AI agents may still access sensitive company data." October 26, 2026.
- 2.SecurityOnline. (2026). "Arrakis Security Report Finds 76% of AI Agents Are Dormant but Keep Their Credentials and Connections." October 21, 2026.
- 3.CIO Influence. (2026). "Arrakis Security Report Finds 76% of AI Agents Are Dormant but Keep Their Credentials and Connections." October 22, 2026.
Company & Funding Background
- 4.Calcalist Tech. (2026). "Former Palantir and Torq veterans raise $8 million Seed to secure the rise of AI agents." August 2, 2026.
Independent Investigation
- 5.METR. (2026). "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident." August 26, 2026.