The 2026 Autonomous Agents Threat Report from Arrakis Security reveals that 76% of active AI agents have remained inactive for at least 60 days. Despite this dormancy, these agents retain functional credentials and active triggers, posing potential security risks.
Data indicates that 44% of these agents have not executed any tasks in 180 days. Furthermore, 24% of the inactive agents are susceptible to being triggered by unsigned webhooks originating from outside their respective organizations.
The findings are derived from anonymized production telemetry gathered from thousands of AI agents within Arrakis customer environments over a 12-week period. CEO Tal Baron noted that while employee access is typically revoked upon departure, unused agents often remain unmanaged due to a lack of clear ownership.
Arrakis Security provides protection through its AI-SPM platform, which performs hourly scans of agent structures, permissions, and metadata. The system identifies shadow agents and misconfigurations, while the AI-TDR component monitors real-time actions against established policies to decide whether to intervene.
