The agent security gap: 54% of enterprises have already had an AI agent incident, and most still let agents share credentials

Artificial intelligence agents are rapidly gaining access to critical enterprise systems and data, but security controls have not kept pace with this expansion. A new study reveals that organizations are deploying AI agents with broad permissions and shared credentials, creating significant vulnerability to incidents. With over half of surveyed enterprises already experiencing confirmed security incidents or near-misses involving AI agents, the gap between agent capabilities and security safeguards has become a pressing concern for modern IT organizations.

A comprehensive survey of 107 enterprises reveals a troubling disconnect between the rapid deployment of AI agents and the implementation of adequate security measures. The research shows that 54% of organizations have already experienced a confirmed AI agent incident or narrowly avoided one. Most critically, the majority of enterprises have not implemented proper identity and access management practices for their agents. Only approximately one-third of surveyed organizations provide each AI agent with its own scoped identity—a fundamental security best practice. Instead, most agents continue to operate with shared credentials, significantly increasing the risk of unauthorized access, lateral movement, and data breaches.

• Widespread vulnerability exposure: More than half of enterprises have already suffered security incidents, indicating this is not a theoretical risk but an active threat
• Inadequate credential management: The majority of organizations still permit agent credential sharing, violating basic security principles
• Limited identity controls: Only 33% of enterprises have implemented per-agent identity scoping, leaving most deployments without proper access boundaries
• Incident response gaps: Organizations lack sufficient containment and monitoring frameworks for AI agent activities
• Compliance and liability risks: Shared credentials and broad permissions create regulatory exposure and potential liability for affected enterprises

The AI agent security gap represents a critical vulnerability in modern enterprise infrastructure. As organizations increasingly rely on AI agents to automate business processes, the absence of proper security controls creates opportunities for both external threats and internal misuse. The 54% incident rate suggests that many organizations have already learned this lesson the hard way. Addressing this security gap through proper identity management, credential isolation, and access scoping is essential for organizations deploying AI agents. Without immediate action, enterprises risk significant data breaches, compliance violations, and operational disruptions as AI agent capabilities continue expanding across their systems.