Arrakis says most idle AI agents still hold live credentials

Arrakis Security's 2026 report says 76% of agents it calls active have not run in 60 days but still keep working credentials and triggers.

Arrakis Security's 2026 Autonomous Agents Threat Report, republished October 21, says 76% of agents it calls active have not run in 60 days, while credentials and triggers remain. Anonymized telemetry from thousands of agents in customer environments over 12 weeks also finds 44% idle for 180 days. According to Arrakis, 24% of dormant agents can be started by an unsigned external webhook, and 22% can send content to a third-party model and act on the reply. Cyber Security News says 20% can obtain results they are not allowed to produce; GBHackers says 20% can pass a task to another agent with different permissions. Both report 82% have at least one exposure. GBHackers says 70% can reach sensitive systems and almost none have verified DLP.