Most AI agents sit unused for months but keep their access

Most AI agents at companies are sitting idle, but they can still be switched on. Arrakis Security says 76% of active agents have not run in 60 days, yet their logins still work and their triggers still fire.

What the report found

AI agents are software helpers that do tasks on their own, often with access to company tools. Credentials are the logins or keys that give them that access. Triggers are the events that start them.

• 76% of active agents have not run in 60 days.
• 44% have not run in 180 days.
• 24% of dormant agents can be started by an unsigned webhook from outside the company.

A webhook is an automatic message that tells a program to start work. Unsigned means it carries no proof of who sent it.

CEO Tal Baron said an employee's access is removed the same day they leave, but when an agent stops being used, nobody removes anything, because in most companies nobody owns it.

What to keep in mind

Arrakis sells security products for agents, so it has a stake in the topic. The data comes from thousands of agents in its customers' environments over 12 weeks. The announcement does not say which industries were included or whether any attack happened.

For any business using AI agents, the practical step is simple. List every agent, name an owner for each, and shut off access for any that are no longer used.