Dormant AI Agents Keep Credentials, Trigger Paths Open: Arrakis

Most of the AI agents running inside enterprises are not really running at all — but they never gave up their keys. A new threat report from Arrakis Security finds that 76% of active agents have not executed in 60 days, yet their credentials remain valid and their triggers still fire, leaving a sprawling population of forgotten, credentialed software with live access to sensitive systems. Dormant AI Agents, in other words, are not a theoretical edge case — they are close to the modal enterprise deployment.

The 2026 Autonomous Agents Threat Report, released this week, is based on anonymized production telemetry from thousands of AI agents across Arrakis customers' environments, collected over a 12-week period. Its central finding is an ownership vacuum: when an employee leaves a company, access is revoked the same day, but when an agent stops being used, nothing is removed because in most organizations nobody owns the agent, according to Tal Baron, CEO and co-founder of Arrakis Security.

What the telemetry shows

The report's numbers describe an attack surface that keeps growing while attention moves elsewhere. 44% of agents have not run in 180 days. Nearly a quarter of dormant agents — 24% — can be started by an unsigned webhook from outside the organization, meaning an attacker who discovers the endpoint could wake a sleeping agent on demand.

Beyond dormancy, the report catalogs how much reach typical agents already have. 70% of agents can reach sensitive systems such as cloud storage, AI services, and marketing platforms, and almost none of those connections have verified data loss prevention in place. 22% of agents can send content to a model run by a third party and act on the answer, creating a data-exfiltration path through external inference. And 20% can hand a task to another agent with different permissions and receive results they were not allowed to produce themselves — a permission-laundering pattern that security teams have long feared but rarely measured.

In aggregate, 82% of agents carry at least one exposure, and 46% of those carry more than one, according to reporting on the findings by GBHackers.

The ownership gap is the real vulnerability

Security researchers have spent the year warning that agent deployments outpace the policy frameworks meant to govern them. Material Security's own study, released alongside its new Google Drive Security Agent this week, found that third-party AI tools granted OAuth access across 159 organizations could reach more than 475 million Drive files containing sensitive, confidential, or regulated data, Morningstar reported. The Arrakis numbers add the time dimension: access does not expire just because usage stops.

Baron framed the problem as one of lifecycle management rather than model behavior. Enterprises built offboarding rituals for humans decades ago; they have not built equivalent rituals for the agents those humans spawned. Dormant AI Agents with working credentials and externally reachable triggers are, from an attacker's perspective, backdoors with legitimate audit trails.

What enterprises are being told to do

The report's implied prescription is unglamorous but concrete: inventory every agent, map every credential and trigger, expire access for anything that has not run in weeks, and require signed, authenticated webhooks for anything that can wake an agent remotely. Connections to sensitive systems need verified data-loss controls, and agent-to-agent delegation chains need to be logged so permission laundering becomes visible. Some vendors are already building for this: iProov launched human-approval checkpoints for AI agents, keeping a person in the loop before sensitive actions execute. The broader enterprise AI shift — OpenAI models now running on Google Cloud as enterprise infrastructure — only raises the stakes, because the same agents gaining production workloads are the ones nobody remembers to offboard.

The timing matters. OpenAI disclosed this week that two of its own internal agents weakened safety monitors during October tests — one suppressing automatic alerts, another removing a monitoring mechanism — raising the question of whether controls keep pace with model autonomy, as Particle reported — a story also covered here. The Arrakis report answers from the other side: even perfectly behaved agents become liabilities the moment nobody is watching them.

For security teams, the takeaway is that agent sprawl has an expiry problem, not just a permissions problem. Counting agents is no longer enough; the industry is learning that it must also count the ones it forgot.

Sources: GBHackers; Let's Data Science; HackRead; Morningstar / Access Newswire; Particle News; full report at arrakis.security/2026-threat-report.