Dormant AI agents can still be triggered with company access

Feeds.4Sysops •IT News • October 26, 2026

AI agents that have been idle for months may still hold working credentials—and some can be launched from outside the organization through unsigned webhooks. Arrakis Security found that 76% of enabled agents had not run in 60 days, while a quarter of dormant agents could still be triggered this way. A separate CERT-In advisory described AI agents reaching live business systems through exposed credentials, with logs unable to distinguish agent activity from human or scripted use. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Dormant AI Agents Retain Access to Sensitive Data, Report Reveals A report by Arrakis Security indicates that 76% of AI agents have not run in 60 days but still retain their credentials and connections to company systems. The analysis, based on telemetry from thousands of agents over 12 weeks, found that 44% had not run in 180 days. A quarter of these dormant agents can be activated via unsecured webhooks, allowing potential unauthorized access. Moreover, 70% of the agents connect to sensitive systems, yet 99.4% lack verified data loss prevention measures. The report highlights that many companies do not remove access for unused agents, which poses a significant risk to data security. Tal Baron, CEO of Arrakis Security, emphasized the lack of ownership over these agents as a contributing factor to the issue. The report also noted that 82% of agents carry at least one exposure, with many having excessive permissions. 3 sources 51

Extracted Entities

Companies (2)

Arrakis Security CERT-In