Forgotten AI agents may still access sensitive company data

AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 Autonomous Agents Threat Report, which examined thousands of agents in customer production environments over 12 weeks. About 76% of enabled agents examined had not run in 60 days, 22.9% had at least one unsecured trigger that could start them, and 70% were connected to at least one sensitive integration, with 99.4% of those connections lacking verified data loss prevention coverage.