Arrakis: 76% of AI agents are dormant but keep credentials and triggers

Arrakis Security's 2026 Autonomous Agents Threat Report, based on 12 weeks of telemetry from thousands of AI agents, found that 76% of agents had not run in 60 days and 44% in 180 days, yet their credentials and triggers still work. 24% of dormant agents can be started by an unsigned external webhook, and 82% carry at least one exposure.

• 76% of agents idle for 60 days, 44% for 180 days
• 24% of dormant agents can be triggered by unsigned external webhooks
• 70% reach sensitive systems with almost no verified DLP
• 82% of agents carry at least one exposure, 46% carry several