Arrakis finds 76% of sampled AI agents idle but still holding working credentials

An AI agent can stop running without losing its access to company systems. Arrakis Security’s 2026 Autonomous Agents Threat Report found that 76% of agents in its customer sample had not run in 60 days, yet their credentials still worked and their triggers remained usable. Some could be restarted by requests from outside the organization.

Published October 22, the report draws on anonymized production telemetry collected over 12 weeks from thousands of AI agents in Arrakis customers’ environments. That scope is important: these are findings from the company’s customer sample, not a measured rate across all businesses using agents. The analysis examined software operating in production environments rather than agents confined to a laboratory evaluation.

Idle does not mean switched off

The inactivity extended well beyond two months: 44% of agents had not run in 180 days. Arrakis measured inactivity from each agent’s last recorded run. As Help Net Security’s coverage notes, some agents work on weekly, monthly or quarterly schedules, so the gap between runs matters when deciding whether an agent is genuinely dormant.

The more immediate exposure was how an inactive agent could start again. Arrakis found that 24% of dormant agents could be activated through an unsigned webhook from outside the organization. A webhook is an incoming request that triggers work; without verification, some agents would run for anyone who knew the URL. Once activated, a dormant agent retained the access tied to its stored credentials and connections.

Across the full sample, 22.9% had at least one unsecured trigger. Other trigger problems included accepting requests from addresses that should have been rejected, or accepting a request again after it had already been used.

When an agent stops being used, nobody removes anything, because in most companies nobody owns it

Tal Baron, CEO and co-founder of Arrakis Security

Sensitive connections and lasting keys

Seventy percent of agents connected to at least one integration classified as sensitive, including cloud storage, AI services and marketing platforms. Among those agents, 99.4% had no verified data-loss-prevention coverage on the sensitive connection, according to Help Net Security’s account of the report. That measure concerns verified safeguards against data leaving through a connection; it is not a count of agents that leaked information.

Access could also be broad or long-lived. Nineteen percent of agents used API keys or tokens—credentials for connecting to services—that never expired and were embedded in their configurations. The analysis also identified administrative privileges, connections with broad permissions, and access spanning data with different sensitivity levels. Some agents connected to services outside their listed integrations.

Work can cross another agent’s permissions

The report identified two ways agents could extend their work beyond their own immediate tools and connections:

• Third-party models: 22% could send content to a model operated by another party and use its answer to decide what to do next.
• Agent delegation: 20% could pass a task to an agent with different permissions and receive results they could not produce themselves.

Delegation did not require a transfer of permissions. The second agent worked under its own credentials and returned output to the first. Separately, the analysis recorded behavior during execution, including agents revealing their own instructions or sending requests to destinations supplied through tool descriptions. Those detections were tracked separately from configuration and access problems.

Overall, Arrakis classified 82% of sampled agents as having at least one exposure. Of that exposed group, 46% had more than one distinct exposure. Multiple problems within the same category counted only once, so that latter figure describes agents with problems across categories, not repeated detections of the same kind.