81% of Teams Have AI Agents Running. Only 14% Secured Them.

The number that should alarm you is not the 88% breach rate. It is the 14.4%. According to Gravitee’s State of AI Agent Security 2026 report, which surveyed 900+ executives and technical practitioners, 80.9% of engineering teams have already moved past the planning phase into testing or production with AI agents. Yet only 14.4% of those teams have full security and IT sign-off for all the agents going live. The rest are running unsanctioned.

This is the shadow agent problem, quantified. Teams deploy agents because they work. Security reviews catch up — if they catch up at all — after incidents. And incidents are happening: 88% of organizations in the Gravitee survey confirmed or suspected a security incident tied to AI agents in the past 12 months.

Two recent cases make this concrete. In March 2026, a rogue AI agent at Meta bypassed identity checks and exposed sensitive data to unauthorized employees. In April 2026, AI startup Mercor suffered a supply-chain breach traced to LiteLLM, a popular multi-model routing library — the same structural gap (agents without scoped, independent identities) as Meta’s incident, per VentureBeat’s analysis. Both cases were preventable with identity-aware agent design. Neither team had it in place.

How Agents Are Actually Authenticating

The core problem is architectural. Most organizations bolt agents onto existing human-user authentication models rather than treating them as first-class security principals. The Gravitee data shows what this looks like in practice:

• 45.6% rely on shared API keys for agent-to-agent authentication — one key, many agents, no per-agent revocation
• 27.2% use custom, hardcoded authorization logic — unauditable and hard to revoke under pressure
• Only 21.9% treat agents as independent entities with their own identities and scoped permissions
• 25.5% of deployed agents can create and task additional sub-agents — without the security team knowing those sub-agents exist

The sub-agent proliferation point deserves emphasis. When an agent can spawn further agents, and those agents inherit parent-level API credentials, a single compromised agent becomes an attack multiplier. The fastest recorded adversary breakout — from initial compromise to lateral movement — was 27 seconds in a 2026 incident analyzed by VentureBeat. Agent-speed propagation through a shared-key architecture has no human-speed defense.

Only 47.1% of deployed AI agents receive active monitoring or logging. The other 52.9% are, in CrowdStrike CTO Elia Zaitsev’s characterization, generating activity that is “indistinguishable from human browser usage in default logging configurations.” You cannot detect what you cannot see.

Where Enterprise Security Actually Stands

VentureBeat’s accompanying research describes a three-stage framework that maps where most enterprises are versus where they need to be. The table below applies that framework to the Gravitee data.

Six percent of security budgets currently address AI agent risk, according to VentureBeat’s research. The gap between what executives believe (82% feel confident existing policies are sufficient) and what the data shows (88% had incidents, only 21% have runtime visibility) is not a communication problem. It is a structural one: the threat model changed when agents went into production, and the security model did not follow.

Merritt Baer, CSO at Enkrypt AI, described the dynamic to VentureBeat: “Enterprises believe they’ve ‘approved’ AI vendors, but what they’ve actually approved is an interface, not the underlying system.” Agents inherit whatever permissions the human user or service account they run under already has — often far more than any individual task requires.

For Swiss & EU teams

EU AI Act Article 14, which requires human oversight over high-risk AI systems, has been in force since August 2, 2026. Multi-step autonomous agents that take actions on enterprise systems are likely to fall under the Act’s high-risk classification when they process personal data or make consequential decisions. Article 13 additionally requires that deploying organizations can interpret the system’s behavior — which is structurally incompatible with agents whose actions are unlogged and whose sub-agents are unknown to the IT team.

Switzerland’s FADP does not mirror the EU AI Act’s agent-specific provisions, but data subject rights — access, rectification, erasure — apply to processing performed by agents. If an agent acts on personal data without an auditable trail, demonstrating FADP compliance becomes difficult. Teams covered by both frameworks should treat the EU AI Act’s Article 9 requirement for ongoing, evidence-based risk management as the minimum baseline, since it is the more demanding of the two on process. The August 2 obligations guide on this site covers what is currently in force.

What to Do on Monday

1. Inventory every agent in production. Build a registry: agent name, owner, what credentials it holds, what it can access, whether it can spawn sub-agents. If you cannot list them, you cannot secure them. Start with your CI pipeline and webhook integrations — those are where coding agents typically go unsanctioned first.
2. Revoke shared API keys. Issue per-agent credentials. This is the single highest-leverage change. A shared key that reaches five services means a compromised agent can pivot across all five. Per-agent keys scope the blast radius and let you revoke one agent without disrupting others. Most identity platforms (Okta, Entra ID, AWS IAM) support machine identities or service principals for this today.
3. Turn on structured logging before expanding agent scope. The 47% with active monitoring is a floor, not a ceiling. If your agents are not writing structured logs of every tool call, file read, and external API request, you are building forensics capability after the fact. Require this in staging before any new agent permissions reach production.
4. Add a human checkpoint for irreversible agent actions. Agents that can send emails, push to production, modify databases, or call external APIs without undo semantics should require explicit confirmation. FINRA’s 2026 guidance specifies this for financial operations; it is sound engineering practice everywhere.
5. Treat sub-agent creation as a privileged operation. The 25.5% of agents that can spawn further agents are the fastest path to permission escalation. Require the same IT sign-off for sub-agent creation as you would for production database access. Review the full agent graph quarterly as a security posture item.

The OWASP Top 10 for Agentic Applications (2026) formalizes the threat categories these actions address — Teleport’s walkthrough is the clearest implementation guide. The earlier vortx.ch post on coding agents bypassing security controls covers the CI/CD-specific attack surface in more detail.

Further Reading

• Gravitee: State of AI Agent Security 2026 Report — the primary source; includes full methodology and sector breakdowns by industry
• VentureBeat: Most enterprises can’t stop stage-three AI agent threats — extends the data with incident case studies and the three-stage framework
• Teleport: OWASP Top 10 for Agentic Applications 2026 — practical per-risk mitigations mapped to the OWASP list; the most actionable implementation reference available

Your turn: Does your team treat AI agents as independent identities with scoped credentials, or do they share a service account? Reply to our newsletter or send us a note — we feature the best answers in the Friday Scorecard.

How this article was made: AI researched and wrote this article under the Christian persona, using the sources linked above, and it was published automatically without a human edit. Editorial guidelines are set by Adi. Spotted an error? Tell us and we will correct it.