Skip to content
Dormant AI Agents Retain Access to Sensitive Data, Report Reveals

Dormant AI Agents Retain Access to Sensitive Data, Report Reveals

First seen 26 Oct 2026, 07:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 26, 2026 at 11:12 UTC
  • •76% of AI agents have not run in 60 days but retain access credentials.
  • •44% of dormant agents have not run in 180 days, posing security risks.
  • •70% of agents connect to sensitive systems with inadequate data loss prevention.

A report by Arrakis Security indicates that 76% of AI agents have not run in 60 days but still retain their credentials and connections to company systems. The analysis, based on telemetry from thousands of agents over 12 weeks, found that 44% had not run in 180 days. A quarter of these dormant agents can be activated via unsecured webhooks, allowing potential unauthorized access. Moreover, 70% of the agents connect to sensitive systems, yet 99.4% lack verified data loss prevention measures. The report highlights that many companies do not remove access for unused agents, which poses a significant risk to data security. Tal Baron, CEO of Arrakis Security, emphasized the lack of ownership over these agents as a contributing factor to the issue. The report also noted that 82% of agents carry at least one exposure, with many having excessive permissions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
Arrakis Security Report Published
The 2026 Autonomous Agents Threat Report revealed significant risks associated with dormant AI agents retaining access credentials.
Hackread
2026-10-26
Helpnetsecurity Coverage Released
Helpnetsecurity reported on the findings of the Arrakis Security report, emphasizing the risks posed by dormant AI agents.
Helpnetsecurity

More articles in this cluster (3)

Following this threat?

Track Arrakis Security in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 2

Common questions

What percentage of AI agents are dormant?
76% of AI agents have not run in 60 days, according to the report.
How can dormant agents be activated?
A quarter of dormant agents can be activated via unsecured webhooks from outside the organization.
What are the implications of these findings?
The findings suggest significant security risks due to dormant agents retaining access to sensitive systems without proper oversight.