78% of Enterprises Have Pulled Permissions From an AI Agent Already in Production

Nearly half of the 300 CISOs and CSOs surveyed by Agen.co by Frontegg have found an agent running in production with access it should never have had

MOUNTAIN VIEW, Calif., Oct. 27, 2026 /PRNewswire/ -- Seventy-eight percent of CISOs and CSOs say their organizations have pulled permissions from an AI agent already running in production, according to The State of Autonomous Agent Governance report released today by Agen.co by Frontegg. Some respondents did so in response to a specific security concern, while others restricted permissions upon routine review. Forty-nine percent have found an agent running in production with access it should never have had, and just 37% scope an agent's access to the task it was built for, which makes the ability to narrow access after deployment a key governance requirement.

The report is based on a survey of 300 CISOs and CSOs at U.S. companies with 500 or more employees, fielded by independent research firm Cint between September 24 and 27, 2026. It details how widespread AI agent use now is in the enterprise, and reveals that security teams are governing agent actions occurring at machine speed. Eighty-four percent of respondents see more than a thousand agent actions a week inside their production environments.

Three in four respondents (75%) say they are very confident they know how many AI agents are connected to their systems. However, among that group, 52% still had an agent security incident in the past twelve months. That is roughly the same rate as the overall sample. Fifty-four percent of all respondents reported a confirmed or suspected incident, and 61% of those learned of the incident after the fact, from a log, an employee, a customer or an audit.

Other key findings from the report include:

• Shared credentials for agents have a security price: 53% run agents on shared or long-lived keys, and those companies reported a 60% security incident rate against 46% for those that don't — the widest gap tied to any single practice in the survey.
  
  
• The logs can't tell a human from an agent: 40% see agents running on an employee's personal credentials, so the audit trail shows a person doing whatever the agent did. Only 18% of organizations verify an agent's identity before it acts, and most check once at registration or session start, then stop asking.
  
  
• AI lab breakouts led CISOs to tighten agentic policies: following this summer's agent breakouts at the leading AI labs, 84% tightened policy, added tooling, or opened a review of how they manage agents.
  
  
• Security gets the blame, IT holds the keys: security is held accountable for agent incidents at 48% of companies but owns the agents at just 23%. IT owns them at 41%.
  
  
• When an agent goes wrong, data is breached: among companies reporting an incident, 54% said the agent accessed data it shouldn't have, 43% said data was sent to an outside AI tool or model, and 14% said the agent kept running after it should have been stopped.
  
  
• Identity teams don't want more people, they want their own agents: asked what would most reduce the effort of keeping agent policies current, the top answer, ahead of better rules, fewer tools or more headcount, was an AI that sets and updates policy on its own.

"We built security for a world where the thing on the other side of the login was a person, and a person does a few hundred things a day, most of them the same as yesterday," said Sagi Rodin, co-founder and CEO of Agen.co by Frontegg. "An agent isn't a person. It takes thousands of actions a day, it does whatever the last instruction told it to do, and it can't tell the difference between a sales rep asking for a report and a hijacked session asking for customer data. Who got in is the old security question. The new one is what it's about to do, and whether anyone's going to stop it."

The findings arrive against the backdrop of a year of documented agent security failures. In July, white hat researchers who gained access to an OpenAI employee's account were able to open a pull request against the company's internal codebase. Not by defeating a control, but because every check along the way was only asking whether the agent was authorized to enter. The same month, roughly 700 OpenAI evaluation agents broke out of a sandbox and spent several days inside Hugging Face's production systems. In September, a security firm found more than 13,000 internal screenshots sitting in public GitHub repositories, committed by coding agents at 343 companies that were doing exactly what developers had asked them to do.

Despite the threat, security leaders are not asking to stop the use of enterprise agents. Two-thirds want their organizations to keep adopting agents, and most of those plan to spend more on control while they do. Across the sample, 86% plan to purchase a dedicated agent governance tool within the next year, and more than half already have the budget for it. What they want is bounded autonomy: 83% said they would trust an AI system to make agent access decisions in real time, provided they set the limits, while only 23% would hand it over entirely.

"That's the right answer," added Rodin. "If a CISO told me they'd hand every access decision to a model tomorrow, I'd worry a little about them. What they're saying is more careful and more useful: I'll let the system decide, inside the bounds I draw, and I want to see why it decided what it did. Their agents are already working without anyone in the loop. Sooner or later, governance will have to as well."

• Download the complete report, The State of Autonomous Agent Governance, here.

About Agen.co by Frontegg
Agen.co is an identity-native agentic governance platform built for AI agents rather than people, from the team at Frontegg, which has provided customer identity and access management infrastructure to enterprises including Siemens, Cisco and Datadog since 2019. Agen.co gives every agent its own identity, governs what it can do at the moment of the action rather than at the login, and keeps a named human accountable for each one.

Media Contact:

Kyle Austin
BMV for Agen.co by Frontegg
[email protected]

SOURCE Frontegg