Nyu-York, Nyu-York, AQSh, 2026-yil 21-oktabr, CyberNewswire
Arrakis Security tomonidan chop etilgan 2026-yilgi Avtonom Agentlar Xavfsizlik Hisobotiga ko'ra, faol agentlarning 76 foizi 60 kun davomida ishlamagan, ammo ularning ma'lumotlari hali ham ishlaydi va ularning triggerlari hali ham ishga tushadi. 44 foizi 180 kun davomida ishlamagan.
Harakatsiz agentlarning 24 foizi tashkilot tashqarisidan imzosiz webhook orqali ishga tushirilishi mumkin.
Hisobot Arrakis mijozlarining muhitlarida minglab AI agentlarining anonimlashtirilgan, aniqlanmaydigan ishlab chiqarish telemetriyasiga asoslangan bo'lib, 12 haftalik davr mobaynida to'plangan.
"AI agent xavfi haqida ko'p muhokama bor, lekin juda kam ma'lumot", dedi Tal Baron, Arrakis Security bosh direktori va hammuassisi. "Xodim ketganda, uning kirish huquqi o'sha kuni olib tashlanadi. Agent ishlatilmay qolganida, hech kim hech narsani olib tashlamaydi, chunki ko'pchilik kompaniyalarda uni hech kim egallamaydi".
Boshqa natijalar:
- Agentlarning 22 foizi uchinchi tomon tomonidan boshqariladigan modelga kontent yuborishi va javobga asoslanib harakat qilishi mumkin.
- Agentlarning 20 foizi turli ruxsatlarga ega boshqa agentga vazifani o'tkazishi va o'zlari ishlab chiqarishga ruxsat etilmagan natijalarni qaytarib olishi mumkin.
- Agentlarning 70 foizi bulutli saqlash, AI xizmatlari va marketing platformalari kabi sezgir tizimlarga kirishi mumkin va bu ulanishlarning deyarli hech birida tasdiqlangan ma'lumotlar yo'qotilishini oldini olish (DLP) tizimi yo'q.
- Agentlarning 82 foizi kamida bitta zaiflikka ega va ularning 46 foizi bir nechta zaiflikka ega.
To'liq hisobot https://arrakis.security/2026-threat-report manzilida mavjud.
Arrakis avtonom agentlarni uch qatlam bo'yicha xulq-atvor intellekti orqali himoya qiladi: agent nima, u nima qiladi va nima uchun.
AI-SPM har bir agentning tuzilishi, ruxsatlari, vositalari va metama'lumotlarini soatiga skan qiladi, shu jumladan hech qachon ishlamaydigan agentlarni ham, yashirin agentlar, ochiq kalitlar va noto'g'ri sozlamalarni aniqlaydi.
AI-TDR belgilangan qoidalar va siyosatlardan chetlanishlarni real vaqtda kuzatadi. Xulq-atvor intellekti dvigateli har bir agentni o'z tarixi, holati, ish vaqti va kontekstidan modellashtiradi: u qanday yetib kelgan va keyin nima qilishi mumkin.
Har bir harakat uchun u davom etish, kuchaytirish yoki aralashish to'g'risida qaror qabul qiladi.
Moranne Shechnick
Arrakis Security
moranne.shechnick@arksec.ai
New York, NY, USA, October 21st, 2026, CyberNewswire
According to the 2026 Autonomous Agents Threat Report, published by Arrakis Security, 76% of active agents have not run in 60 days, but their credentials still work and their triggers still fire. 44% have not run in 180 days.
24% of dormant agents can be started by an unsigned webhook from outside the organization.
The report is based on anonymized, unidentifiable production telemetry from thousands of AI agents in Arrakis customers’ environments, collected over a 12-week period.
“There’s a lot of discussion about AI agent risk, and very little data”, said Tal Baron, CEO and co-founder of Arrakis Security. “When an employee leaves, their access is removed the same day.
When an agent stops being used, nobody removes anything, because in most companies nobody owns it”.
Other findings:
- 22% of agents can send content to a model run by a third party and act on the answer.
- 20% of agents can pass a task to another agent with different permissions, and get back results they aren’t allowed to produce themselves.
- 70% of agents can reach sensitive systems, such as cloud storage, AI services, and marketing platforms, and almost none of those connections have verified data loss prevention (DLP).
- 82% of agents carry at least one exposure, and 46% of those carry more than one.
The full report is available at https://arrakis.security/2026-threat-report.
Arrakis secures autonomous agents through behavioral intelligence across three layers: what an agent is, what it does, and why.
AI-SPM scans each agent’s structure, permissions, tools, and metadata hourly, including agents that never run, surfacing shadow agents, exposed keys, and misconfigurations.
AI-TDR monitors actions in real time for deviations from defined rules and policies. The behavioral intelligence engine models each agent from its own history, posture, runtime, and context: how it got there and what it could do next.
For each action, it decides whether to continue, escalate, or intervene.
Moranne Shechnick
Arrakis Security
moranne.shechnick@arksec.ai