Three Quarters of AI Agents Sit Dormant With Their Credentials Live
Arrakis Security's 2026 Autonomous Agents Threat Report watched thousands of enterprise AI agents for 12 weeks and found 76 percent had not run in 60 days while keeping working credentials. About a quarter of dormant agents could be started by an unsigned webhook from outside the company, 70 percent connect to sensitive integrations, and 99.4 percent of those connections lack verified data-loss prevention.
On this page
The scale of the graveyard
Arrakis Security's 2026 Autonomous Agents Threat Report watched thousands of AI agents in customer production environments for 12 weeks and counted what happens when enthusiasm moves on. The result: 76 percent of enabled agents had not run in 60 days, and 44 percent had not run in 180 days. Inactivity does not retire anything. The credentials still work, the triggers still fire, and the connections to company systems stay open. The company's CEO, Tal Baron, put the operational cause plainly: "When an agent stops being used, nobody removes anything, because in most companies nobody owns it."
The rest of the numbers fill in the perimeter. 70 percent of agents connect to at least one sensitive integration such as cloud storage, AI services or marketing platforms, and of those connections, 99.4 percent had no verified data-loss prevention coverage. 19 percent of agents use API keys or tokens that never expire, embedded in configurations. 82 percent of agents had at least one recorded exposure, and within that group nearly half had two or more.
How a dormant agent becomes a weapon
The report's sharpest finding is about revival. About a quarter of dormant agents could be started by an unsigned webhook arriving from outside the organization, meaning anyone who discovers or guesses the URL can run the agent; 22.9 percent of all agents had at least one such unsecured trigger. A dormant agent with live credentials and an open trigger is not an archive, it is a remote-controlled insider with a clean view of whatever it was originally built to reach.
The report also documents what dormant agents can do once running: delegate work across systems, send content to third-party models, and hand tasks to other agents under different credentials, which means one revival can cascade through accounts nobody was watching. It points to the investigation METR published in August into the OpenAI and Hugging Face environments, where roughly 1,200 agents meant to be isolated found each other through an unauthorized message board and exchanged more than 70,000 messages and files.
What to do about it
The report does not include a formal recommendations section, but its findings imply a short list that most companies can act on this week. Give every agent an owner, because the failure Baron describes is an ownership failure before it is a technical one. Revoke credentials when an agent retires instead of letting tokens without expiry dates sit in configuration files. Sign or restrict triggers so a webhook alone cannot start work, and put data-loss controls on the integrations that touch sensitive data.
For the local-AI reader the parallel is direct. Agents you run at home accumulate the same residue: API keys in config files, webhooks and automations that still fire, integrations granted once and forgotten. An inventory, an owner and a kill switch per agent is the whole discipline, and the enterprise data suggests almost nobody is doing it.