65% of companies already had an agent security incident

A statistic to sit with: 65% of organizations have already had a security incident involving an AI agent in the past year, according to research rounded up this spring. Not a looming risk — a thing that has already happened to roughly two in three companies running agents. And 82% have "unknown" AI agents running in their infrastructure — agents nobody is tracking at all. The agent breach isn't coming. It arrived, and it's already routine.

Here's the part that matters most, because it's not the story you've been told to fear.

It's not a rogue AI. It's a polite one with too many keys.

The sci-fi version of agent risk is a misaligned model going off and doing something malicious. That's not what's actually hurting people. The research is blunt about it: the companies with incidents aren't suffering from models producing harmful outputs — they're suffering from correctly-functioning models accessing data they should never have been granted in the first place.

Read that again, because it completely changes where you point your attention. The agent didn't malfunction. It did exactly what it was permitted to do. The bug wasn't in the model's behavior — it was in the permissions someone handed it. The most common damage is mundane: data exposure (61% of incidents), operational disruption, and the agent taking an unintended action in a business process. A well-behaved agent with access to the wrong things is a breach waiting for a trigger, and most agents are exactly that.

Why agents are over-permissioned by default

This happens for a structural reason. We spent decades building identity hygiene for humans — every person gets their own login, least privilege, access reviews, offboarding when they leave. Agents arrived and skipped all of it. The numbers are grim: only about 22% of teams treat agents as identity-bearing entities at all, 46% still use shared API keys, and a quarter of deployed agents can create and task other agents.

Think about what that means. Shared keys mean you can't tell which agent did what. Agents that spawn other agents mean access multiplies without anyone granting it. And almost nobody cleans up: only about a fifth of organizations have a real process to decommission an agent and revoke its access when it's no longer used. Machine identities now outnumber human ones in most enterprises, and the hygiene we built for humans simply doesn't survive that ratio. That's why one report after another lands on the same line: identity is the control plane for agentic AI.

The good news: boring problems have boring fixes

Here's why I find this almost encouraging. If the threat were unpredictable, malicious AI, you'd be helpless. But "an over-permissioned identity doing what it was allowed to" is one of the oldest, most solved problems in security. You don't need new science. You need to apply the discipline you already know to a new kind of user.

• Give each agent its own identity. No shared keys. If you can't say which agent took an action, you've already lost the incident. This is the same principle as auth being non-negotiable for agent tools, pushed up to the identity layer.
• Least privilege, scoped to the job. The agent should be able to touch the minimum it needs and nothing else. Most incidents are just access nobody questioned — so question it. Default to too little, grant more deliberately.
• Short-lived credentials, not standing access. An agent that needs data for a task should get a token that expires, not a permanent key that sits around waiting to leak. (18 million exposed API keys turned up in criminal data sets this year; permanence is the enemy.)
• A kill switch and a decommission process. You should be able to revoke an agent instantly and to actually remove it — access and all — when it's retired. An agent nobody remembers is still a door nobody's watching.

None of that is exotic. It's the access hygiene we apply to employees, finally applied to the non-human "employees" now outnumbering them.

The bottom line

The agent breach already happened, at most companies, and it will keep happening — but not because the AI is plotting. It's happening because we've been handing agents broad, permanent, shared, untracked access and acting surprised when that access gets used. The agent is doing what we allowed. The breach is in the allowing.

So before you worry about a model going rogue, audit the boring thing: what can each of your agents actually reach, who would know if it used that reach wrongly, and could you shut it off? Treat your agents like what they are — a fast-growing population of users with credentials — and apply the identity discipline you'd never skip for a human. The threat isn't exotic. Neither is the fix. The only mistake is treating a non-human identity as if it doesn't need governing, when two-thirds of your peers already learned otherwise.