76% of AI Agents Are Idle. None of Them Lost Their Keys.

76%. That’s the share of enabled AI agents, across thousands of agents in production environments, that hadn’t run in the last 60 days when Arrakis Security pulled its telemetry. Not disabled. Not decommissioned. Enabled, idle, and — this is the part that matters — still holding every credential and connection they were ever given. Arrakis published the number October 26 in its 2026 Autonomous Agents Threat Report, built from twelve weeks of anonymized production data across its customer base.

Arrakis CEO Tal Baron put the underlying problem in one sentence: “When an agent stops being used, nobody removes anything, because in most companies nobody owns it.” That’s not a technology gap. It’s an org-chart gap wearing a security report’s clothing, and it’s the more useful way to read every number that follows.

The numbers that actually compound

44% of agents in the sample hadn’t run in 180 days — so the 76%-at-60-days figure isn’t agents between projects, it’s agents that are functionally retired without anyone declaring them retired. 70% of all agents in the sample connect to at least one sensitive integration: a database, a ticketing system, a code repo, a payments API. Of those sensitive connections, 99.4% had no verified data loss prevention control checking what the agent actually does with that access. And 19% of agents use non-expiring API keys embedded directly in their configuration — not short-lived tokens, not anything with an automatic kill switch, just a key that works until a human remembers to rotate it.

Stack those three next to the dormancy number and you get the actual threat model, not just a pile of bad stats. Most agents touch something sensitive. Most of those sensitive connections aren’t monitored for misuse. A fifth of agents carry credentials that never expire on their own. And three-quarters of them are sitting unused, which in security terms doesn’t mean “safe,” it means “unobserved” — nobody’s watching the logs of a thing nobody thinks is running.

The part that turns this from risk into exploit

25% of dormant agents, per the report, can be started by an unsigned webhook reachable from outside the organization. That’s the number I’d flag first if I were running a security review this week. An attacker doesn’t need to steal a credential to reactivate one of these agents — they need to find an endpoint that was never meant to be internet-facing in the first place, and the report says a quarter of dormant agents have exactly that exposure. More broadly, 22.9% of all agents in the sample, active or not, had at least one unsecured trigger of some kind — so this isn’t purely a dormancy problem, it’s a trigger-hygiene problem that dormancy happens to make worse, because nobody’s checking an idle agent’s trigger configuration the way they might for one that shows up in a weekly usage report. A reactivated agent doesn’t get a fresh, scoped-down set of permissions on wake-up. It gets whatever it had when it went to sleep, which per the numbers above is very likely a non-expiring key and a connection nobody’s watching.

82% of agents in the dataset had at least one recorded exposure of some kind, and 46% of those had two or more distinct exposures stacked on the same agent. That’s not a report describing a theoretical risk category. It’s a report describing a condition that’s already present in most of the agents Arrakis looked at.

What this actually means if you run agents in production

The comparison that clarifies this for me is the one nobody in agent tooling draws often enough: a departing employee gets offboarded — accounts disabled, badges revoked, access reviewed — on a process every company already has, however imperfect. An agent that stops being used gets nothing, because it was never treated as having an owner who could initiate that process. The fix isn’t a new security product bolted on top. It’s applying the service-account discipline that already exists in most infrastructure teams — owner tags, mandatory credential expiry, automatic deactivation after a defined idle window — to agents specifically, instead of letting them live in the gap between “application” and “user account” where neither team’s offboarding checklist applies.

If you’re auditing your own agent fleet after reading this, start with the two numbers that are cheapest to check and most likely to be true of your own environment too: how many of your agents use a credential with no expiry, and how many of your agent-triggering webhooks are reachable without a signature check. Those are implementation details, not a mature governance program, and Arrakis’s data says most organizations haven’t gotten to either one yet.

One more thing worth doing this week, cheap and specific: pull the list of every agent that hasn’t run in 60 days and ask one question about each — who approved its original access, and are they still the person who’d notice if it reactivated. If the answer is “I don’t know” more than once, you’ve just reproduced Arrakis’s dataset inside your own org, and you now know exactly where to start.

Sources

Help Net Security: Forgotten AI agents may still access sensitive company data (October 26, 2026, reporting on Arrakis Security’s 2026 Autonomous Agents Threat Report).