Dormant AI agents can leave active access behind, Arrakis research finds

A production-environment study highlights the gap between stopping an agent's work and retiring its credentials and triggers.

AI agents can remain connected to business systems long after their last useful run. Help Net Security's October 26 account of Arrakis Security's 2026 Autonomous Agents Threat Report says 76% of enabled agents examined had not run in 60 days, while their credentials and system connections remained available.

The reported analysis covered thousands of agents in customer production environments over twelve weeks. It also identified unsecured triggers and sensitive integrations. These are findings from the examined environments, rather than a census of all enterprise AI deployments. Infrequently scheduled agents also need their operating schedule considered before inactivity is classified as abandonment.

The distinction between use and authority is the central issue. Disabling a routine or ceasing to call an assistant does not necessarily revoke the account, stored connection or webhook that allows it to act. Someone who can reactivate the workflow may inherit access that its original owner no longer remembers.

For a platform team, the useful record therefore includes who owns an agent, the purpose of each connection and when the access should expire or be reviewed. Retirement needs to follow those dependencies, rather than ending when a scheduled run is switched off.

The age distribution extends well beyond a missed weekly schedule: 44% of examined enabled agents had not run for 180 days. Across the sample, 22.9% had at least one unsecured trigger. These figures connect two otherwise separate questions—whether an agent is still needed and whether an outside request can start it—with the permissions waiting behind that trigger.

Sources

- [Forgotten AI agents may still access sensitive company data](https://www.helpnetsecurity.com/2026/10/26/arrakis-dormant-ai-agent-risks-report/) — Help Net Security reporting on Arrakis Security