The agent security gap: 54% of enterprises have already had an AI agent incident, and most still let agents share credentials
More than half of enterprises have already experienced an AI agent security incident or near-miss, with most sharing credentials and few isolating their highest-risk agents. The security stack is largely borrowed from model providers, and spending on agent security is a thin slice of the overall budget.
What happened
A survey of 107 enterprises found that 54% have had an AI agent security incident or near-miss, with most sharing credentials and only 32% giving every agent its own scoped identity. Only 30% isolate their highest-risk agents in sandboxes, and the security stack is overwhelmingly borrowed from model providers like OpenAI and Google.
Why it matters
This lack of proper agent security measures puts enterprises at risk of significant damage if an agent is compromised. It also highlights a gap between the autonomy granted to agents and the controls in place to contain them. Enterprises need to address this gap to prevent incidents and protect their systems and data.
The takeaway
Enterprises should prioritize building purpose-built agent security controls, including scoped identity and isolation, to mitigate the risk of AI agent security incidents. This may require investing in dedicated agent-security vendors and tools to address the current provider-native default.
Our plain-English take, written from public reporting for operational business owners. Always read the original for full context.
Nayre builds the AI systems behind stories like this.
Chatbots, workflow automation, finance intelligence, and internal knowledge systems. Built for operational teams, shipped in days.