Report: 76% of AI Agents Dormant With Live Credentials

Most of the AI agents deployed inside companies are rarely doing anything at all. They sit idle for months — but their credentials stay live, their triggers still fire, and a quarter of the dormant ones can be woken up by an unsigned webhook from outside the organization. That is the headline finding of the 2026 Autonomous Agents Threat Report from Arrakis Security, released October 21, 2026, and it puts numbers to a risk that has mostly been discussed in hypotheticals.

Call them the problem of AI Agents Dormant: idle agent identities that retain full authorization. According to the report, which is based on anonymized production telemetry from thousands of AI agents across Arrakis customers' environments collected over a 12-week period, 76% of active agents have not run in 60 days, yet their credentials still work and their triggers still fire.

According to the report, which is based on anonymized production telemetry from thousands of AI agents across Arrakis customers' environments collected over a 12-week period, 76% of active agents have not run in 60 days, yet their credentials still work and their triggers still fire. The decay runs deeper: 44% of agents have not run in 180 days, and 24% of dormant agents can be started by an unsigned webhook from outside the organization, as reported by Security Ledger via CyberNewswire.

What the telemetry shows

The report goes well beyond dormancy. About 22% of agents can send content to a model run by a third party and act on the answer — an exfiltration path that barely exists in the human-equivalent world, where an employee cannot legally ship company data to an outside model and act on its verdict. Another 20% can pass a task to another agent with different permissions and get back results they are not allowed to produce themselves, a classic permission-hopping maneuver.

Reach is the third leg. Some 70% of agents can touch sensitive systems — cloud storage, AI services, marketing platforms — and almost none of those connections have verified data loss prevention in place, according to the report. Independent coverage of the findings by LetsDataScience adds two more sobering figures: 82% of agents carry at least one exposure, and 46% of those carry more than one. An agent that has not run since spring can hold more live access than the contractor who built it, which is precisely why the report's account of AI Agents Dormant deserves attention beyond the security community.

Why nobody revoked the keys

The report's most quoted line is less about technology than about ownership. Arrakis CEO and co-founder Tal Baron told reporters that when an employee leaves, access gets removed the same day, but when an agent stops being used, nothing is removed because no one owns it. The metaphor lands because it is operationally true: offboarding scripts cover humans, but retiring an agent is usually a product decision that no team is assigned to execute.

That ownership vacuum is already colliding with the financial system. Major U.S. banks including JPMorganChase, Citigroup, Bank of America and Charles Schwab have moved to block unauthorized third-party agents from logging into customer accounts or moving money, permitting only read-only access in most cases — a posture this outlet covered in a recent piece on banks blocking AI agents from touching customer money. The Arrakis data explains part of the banks' caution: an agent fleet is effectively a crowd of immortal former employees whose keycards were never collected.

What agent operators should do now

The report's findings point toward a short, unglamorous checklist. First, every agent needs a named human owner, with credential review on a schedule rather than on vibes. Second, webhooks that can wake agents should be signed and verified — the fact that a quarter of dormant agents accept unsigned external triggers is a configuration problem before it is an attack problem. Third, data loss prevention needs to extend to agent-to-model traffic, not just human browsers, since nearly a quarter of agents already ship content to third-party models.

Longer term, the fix is architectural: give agents identities that expire, environments they cannot escape, and least-privilege access by default. Hardware-isolated microVMs per agent — the model Google is productizing with its Agent Compute Engine, announced at AGNTCon + MCPCon this week — would at least confine a compromised agent to a sandbox that contains no standing credentials. And shared standards matter: the recent donation of agent skills to the Agentic AI Foundation by Anthropic and OpenAI suggests the ecosystem is starting to coordinate on safe agent behavior, though credential lifecycle management remains largely every-operator-for-themselves.

Hackread's coverage of the report notes that the telemetry is a first real dataset rather than another opinion piece, and that is arguably the point. For two years the agent economy has grown on the assumption that deployed agents are assets. The Arrakis numbers suggest a large share of them are actually dormant attack surface — powered-down machines with the doors still unlocked. The industry that builds them will now have to build the offboarding process it forgot to include.