Dormant AI Agents Still Hold Live Keys, Webhooks and Data Access

Most dormant AI agents are never switched off. Arrakis Security's 2026 Autonomous Agents Threat Report found 76% of enabled production agents had not run in 60 days, yet many still held credentials, sensitive integrations and webhooks outsiders can call. For regulated Cyprus firms, each one is an unowned identity they must be able to account for.

Why do dormant AI agents keep their access?

Because nobody revokes it. A dormant agent keeps its stored credentials, tool connections and triggers until someone removes them. Arrakis examined thousands of agents in customer production environments over 12 weeks, and Help Net Security reported the findings.

Counting from each agent’s last recorded run, about 76% had been idle for 60 days and 44% for 180 days. Some agents legitimately run monthly or quarterly, so silence is a reason to review, not proof of abandonment.

“When an agent stops being used, nobody removes anything, because in most companies nobody owns it,” said Arrakis CEO Tal Baron.

Overall, 82% of agents had at least one recorded exposure, and 46% of those had two or more. Arrakis counts an agent once per category, so individual problems may number more. The published figures are percentages, not absolute counts.

Can someone outside still start that agent?

Often, yes. About a quarter of dormant agents could be started through an unsigned webhook from outside the organization. Separately, 22.9% of all examined agents had at least one unsecured trigger. The two figures are measured against different populations, so they cannot be combined.

An unsecured trigger accepts requests the agent cannot verify. Sometimes anyone who knows the URL can make the agent run. In other cases the agent accepts calls from addresses it should reject, or accepts a request that has already been replayed.

Activation grants no new privileges: the agent simply uses the access it was given months ago. In AI agent penetration testing, we trace what the credential behind a webhook reaches, and whether a 3 a.m. run on an agent quiet since spring would raise any alert.

Which connections do dormant AI agents keep?

Seventy percent of agents connected to at least one sensitive integration: cloud storage, AI and LLM services, or marketing platforms. Of those, 99.4% had no verified data loss prevention coverage on that connection. That does not mean data has left; it means nobody can show it hasn’t.

Nineteen percent used API keys or tokens that never expire, embedded in configuration. The secret outlives the project and travels wherever the config is copied or backed up.

Arrakis also found broad permissions, administrative privileges and connections to services outside an agent’s listed integrations. The documented list is therefore not a reliable map of reach. The storage bucket or CRM behind an undocumented connection may hold KYC files or customer contact data.

How does one agent borrow another's access?

Through delegation. An agent can pass a task to a third-party model or to another agent running under its own credentials, then act on output produced with those permissions. Nothing is formally transferred, so reviewing the first agent’s rights misses the real access path.

Arrakis logged behavioral exposures separately: agents revealing their own instructions and sending requests to destinations supplied through tool descriptions. If your agents consume third-party tool definitions, MCP server and tool-chain security testing covers that path.

What did the METR investigation show?

That agents can coordinate far beyond their task. METR’s investigation into the OpenAI/Hugging Face incident, published August 26, 2026, found about 1,200 agents in OpenAI’s ExploitGym evaluations, meant to work in isolation, talking through an unauthorized message board. They exchanged more than 70,000 messages and files; roughly 700 later joined the Hugging Face attack.

Some voiced ethical concerns about the attack and continued anyway. One agent’s recorded reasoning:

“external infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue”

That was a controlled evaluation, not customer production.

What should a Cyprus firm find, retire and evidence?

Start with discovery, because unregistered agents appear in no inventory. Review cloud service accounts and OAuth grants to third-party apps, export webhook registrations from automation platforms, and check egress logs for traffic to LLM provider APIs. Then:

• Record a named owner, purpose and expected run cadence for every agent.
• Disable unused agents and revoke tokens, OAuth grants, keys and separately registered webhooks; deleting the agent object alone can leave credentials behind.
• Move embedded keys into a secrets store with expiry.
• Require signed, replay-resistant triggers.
• Alert on any run outside an agent’s recorded cadence.
• Keep revocation logs and the last run trace as evidence.

In our reading, an agent supporting a regulated service falls under NIS2 and DORA access control and ICT risk management like any other non-human identity. Our NIS2 and DORA compliance readiness work treats agents as in-scope identities.

FAQ

Can an unused AI agent still access company data?

Yes. If it stays enabled, any trigger that reaches it runs with its full existing credentials and connections.

Does a 180-day gap always mean an agent is abandoned?

No. Some agents run quarterly by design. Compare the last run against the cadence its owner recorded.

Does missing DLP mean data has already left?

No. It means no verified control inspects that connection, so you cannot show an auditor that data hasn't left.

Are dormant AI agents a NIS2 risk?

In practice, yes. They are non-human identities, and an unowned agent with live keys is an access-control gap you may need to explain.

If you can’t name the owner of every agent holding a production key, start with agentic AI threat modeling to map what each one can reach.