1) The fact
A recent survey revealed that 54% of enterprises have experienced at least one security incident involving AI agents. Even more alarming: most of these organizations continue to allow their AI agents to share credentials across different systems and platforms, ignoring one of the most basic information security practices. The study, reported by VentureBeat, surveyed security and IT professionals at mid-to-large enterprises in the US and Europe. Incidents ranged from sensitive data leakage to agents executing unauthorized transactions or granting themselves elevated permissions on corporate systems.
2) Context
AI agents — autonomous systems that execute tasks without direct human supervision — are being adopted at breakneck speed by companies seeking to automate workflows, customer service, data analysis, and IT operations. Tools like coding assistants, support chatbots, and process automation agents are already deployed in thousands of organizations, often with broad access to internal databases, APIs, and cloud services. However, the security of these agents is frequently an afterthought in the rush to adoption. Large Language Models (LLMs) and autonomous agents operate with permissions that are, in many cases, broader than those of human employees, creating significant attack surfaces that few enterprises monitor adequately or audit regularly.
3) Analysis
The fact that more than half of enterprises have recorded incidents with AI agents is not surprising — what is shocking is that most continue to share credentials even after those incidents. This reveals a deep disconnect between the speed of technology adoption and the maturity of security controls. AI agents that share credentials essentially nullify the principle of least privilege, a cornerstone of cybersecurity. If one agent is compromised — whether through prompt injection, jailbreaking, or vulnerability exploitation — the attacker gains access to every system for which that agent holds credentials. The problem is structural: most enterprises still treat AI agents as extensions of existing tools, rather than as new actors on the network that require their own auditable identity, authentication, and authorization. Until this mindset changes, the incident rate will only grow as AI agent adoption accelerates.
4) What to watch
- Emerging regulations specific to AI agent security (EU AI Act, NIST AI RMF, upcoming CISA guidelines) - Launch of Identity and Access Management (IAM) tools adapted for non-human agents - Accelerated growth in the AI Security Posture Management (AI-SPM) market - Shift in enterprise security posture following high-profile AI agent incidents
Source: VentureBeat
