54% of Enterprises Report AI Agent Security Incidents

A new study reveals that 54% of enterprises have experienced security incidents or near-misses involving AI agents, highlighting a critical gap in how organizations manage these autonomous systems. The research, based on a survey of 107 companies, found that many still allow AI agents to share credentials and access sensitive systems without adequate controls. AI agents—software programs that can act autonomously to complete tasks—are becoming increasingly common in enterprise environments. They handle everything from customer support to data analysis to code deployment. However, their autonomy also introduces new risks. If an agent is compromised or misconfigured, it can cause significant damage before human operators intervene. The study identified several troubling patterns. Nearly half of the surveyed enterprises reported that their AI agents could share login credentials with other systems, creating a vector for lateral movement in case of a breach. Many organizations also lack proper identity management for agents, treating them as extensions of human users rather than distinct entities with limited permissions. Security experts recommend implementing strict identity and access management (IAM) policies for AI agents, including the use of short-lived tokens, role-based access controls, and continuous monitoring of agent behavior. The principle of least privilege should apply to agents just as it does to human employees. The findings come at a time when AI adoption is accelerating across industries. As agents become more capable, the potential for misuse grows. The study serves as a wake-up call for CISOs and IT leaders to reassess their security postures and ensure that agentic AI does not become the weakest link in their defenses.