The Ghosts in the Org Chart Still Have Badge Access
The 2026 Autonomous Agents Threat Report from Arrakis Security studied anonymized production data from thousands of AI agents over 12 weeks (CyberNewswire, 2026). Of the active agents, 76% had not run in 60 days, yet their credentials still worked and their triggers still fired. A total of 44% had not run in 180 days.
Think of a former intern whose badge still opens the server room. Nothing is happening, which is exactly why nobody checks. Arrakis CEO and co-founder Tal Baron said nobody removes anything, because in most companies nobody owns it (CyberNewswire, 2026).
What a Sleeping Agent Can Still Do
Dormant does not mean harmless. Among dormant agents, 24% could be started by an unsigned webhook from outside the organization, and 22% could send content to a third party hosted model and act on its response (CyberNewswire, 2026).
Another 20% could hand a task to an agent with different permissions and receive results they could not produce themselves (CyberNewswire, 2026).
| Idle for 60 days | 76% |
| Idle for 180 days | 44% |
| Startable by unsigned webhook | 24% |
| Can use outside model | 22% |
| Can borrow another agent | 20% |
Who Owns the Robot Nobody Remembers?
A fair note of skepticism is in order. The report comes from a company that sells tools to scan and monitor agents, so the numbers deserve a raised eyebrow (CyberNewswire, 2026). The question it raises is still a good one, because unused agents with working credentials remain usable paths for an attacker.
The fix is dull but effective. Give every agent a named owner who can switch it off when it stops being useful.
Nothing is happening, which is exactly why nobody checks.
What You Can Actually Do About It
List the AI tools, automations, browser extensions and connected apps you have authorized, then remove the ones you no longer use and revoke their access. At work, ask your IT team who owns each agent and what it can reach. Prefer tools with limited permissions, and review them on a regular schedule. Then ask yourself, how many of the AI tools you connected to your accounts do you still use?
References
CyberNewswire. (2026, October 21). Arrakis Security report finds 76% of AI agents are dormant but keep their credentials and connections. Hackread. https://hackread.com/arrakis-security-report-finds-76-of-ai-agents-are-dormant-but-keep-their-credentials-and-connections/
Comments (0)
No comments yet — be the first to comment.
Leave a comment