76% of AI Agents Are Dormant but Still Hold Their Keys: A 20-Minute Audit for Small Businesses

What the Report Found

Security firm Arrakis published its 2026 Autonomous Agents Threat Report on October 21, 2026. Based on anonymized production telemetry from thousands of AI agents in its customers’ environments over a 12-week period, it found that 76% of active agents have not run in 60 days, and 44% have not run in 180 days. Their credentials and triggers still work. The report also says 24% of dormant agents can be started by an unsigned webhook from outside the organization, and that 82% of agents carry at least one exposure.

These are customer environments of a security vendor, mostly larger organizations, so the percentages will not map exactly onto a ten-person company. The pattern does: agents get set up for a trial, the trial ends, and nobody switches off the access.

Three Steps for a 20-Minute Audit

• List every agent and automation that can act for you. Include chatbots, scheduled workflows, and AI features inside tools such as your CRM, email, and accounting software. You cannot secure what you have not listed. This is our suggestion, not part of the report.
• Switch off anything unused for 60 days. The report’s 60-day mark is a practical cut-off. Revoke the API keys and connections of idle agents rather than just pausing them, so dormant access cannot be reused.
• Check what each remaining agent can reach. Give each agent access only to the files and systems its job needs, and confirm external triggers such as webhooks are signed or removed.

This Week’s Step

Open the settings of the three tools where you first tried AI, and revoke any connection or API key you no longer use.