Report: 76% of AI agents idle for 60 days but keep data access

Arrakis Security analyzed thousands of production AI agents over 12 weeks: 76% had not run in 60 days and 44% in 180 days, yet retained credentials and connections to corporate systems. 22.9% had unsecured triggers, and 82% had at least one recorded exposure.

• 76% of agents idle for 60 days, 44% for 180 days
• 22.9% had unsecured triggers, including unsigned webhooks
• 70% connected to sensitive services, 99.4% without verified DLP
• 82% of agents had at least one recorded exposure