76% of Production AI Agents Sat Idle for 60 Days—But Kept Their Access Keys
krishnan · x · 2026-10-28
An Arrakis Security study tracked thousands of AI agents in real customer environments over 12 weeks and found widespread 'zombie agents': 76% of enabled agents hadn't run in 60 days and 44% hadn't run in 180—yet their credentials remained active.
Key findings:
- 82% had at least one security exposure
- 22.9% had a trigger anyone with the URL could fire
- 70% were connected to sensitive resources, and 99.4% of those had no verified data loss controls
- 19% used API keys that never expire
The core problem: employees get offboarded when they leave, but quiet agents are never cleaned up because nobody owns them. An agent is 'a set of permissions with a to-do list attached'—we build agents like apps but govern them like nothing. The author argues access should decay by default rather than persist indefinitely.
More from coding & agent
- SSH MCP deprecated, succeeded by Rust rewrite SSH-Connect — modelcontextprotocol · 2026-10-28
- adis MCP connector queries Czech VAT unreliability and bank accounts — modelcontextprotocol · 2026-10-28
- Open-source Deepthink claims agent-swarm test-time scaling lifts small-model scores from 14% to 65% — Ryoiki-Tokuiten · 2026-10-28
- Harmonic launches Aristotle: AI that formally verifies code, starting with C and Verilog — wellecks · 2026-10-28
- Dev Calls on X to Ban AI Slop Reply Accounts Flooding viral Threads — generativist · 2026-10-28
- Grok Build v1.0.72 Cuts MCP Context Usage Nearly in Half With Multi-Agent Terminal Upgrades — XFreeze · 2026-10-28