Arrakis Security Finds 76% of AI Agents Dormant but Still Connected

Arrakis Security says in a press release that 76% of observed AI agents had not run in 60 days, although their credentials still worked and their triggers remained active. Forty-four percent had not run in 180 days.

The company found that 24% of dormant agents could be started through an unsigned webhook from outside the organization. It also reported that 70% of agents could access sensitive systems such as cloud storage, AI services and marketing platforms, with almost none of those connections using verified data loss prevention.

Another 22% could send content to a model operated by a third party and act on its response. Twenty percent could pass tasks to agents with different permissions, while 82% had at least one exposure and 46% of that group had multiple exposures.

The report used anonymized production telemetry collected from thousands of AI agents in customer environments over 12 weeks. Arrakis sells security tools for AI agents, and the figures come from its own customers.