Nearly half of firms report rogue AI agent actions

Salt Security has published research suggesting that nearly half of enterprises have confirmed or suspected an AI agent took an unauthorised action in the past year. The findings point to a gap between the spread of agentic AI and the controls used to monitor it.

The study drew on a survey of more than 380 security and technology professionals, along with telemetry from hundreds of customer environments. It found that 49.8% of respondents said an AI agent in their organisation had taken an action that was not intended, expected or authorised.

Among those respondents, more than half said the incident involved an unauthorised external API call or transaction. More than 40% said an agent had modified or deleted data.

The figures sit alongside broader evidence of how widely AI agents are now used in large organisations. According to the research, 86.4% of respondents reported at least one AI agent operating in their organisation, while 59.5% said they run more than ten.

Many of those systems do not operate in isolation. The survey found that 76.8% of respondents use agents that chain actions across other agents, tools and APIs, creating sequences that no single team designed in advance.

Tracing problem

A central issue identified in the report is the difficulty organisations face in reconstructing what an AI agent has done. Only 12.5% of respondents said they could consistently trace a complete agent path across all agents, from the initial instruction through tools and APIs to the outcome.

More than 60% said they would need hours or days of manual work to determine what a specific agent had done the previous day. That suggests many businesses lack a real-time or near real-time view of agent activity once these systems are embedded in operations.

Containment is also limited. Just 17.5% of respondents said they could automatically stop an agent that begins behaving unexpectedly in production. Most said intervention would require manual action or taking an application offline.

"The data shows a gap that is already producing real operational consequences," said Roey Eliyahu, Chief Executive Officer of Salt Security.

"Organisations are deploying agents and granting them access to enterprise data, APIs and services before they can trace what those agents are doing or stop them automatically when something goes wrong. Closing that gap is the discipline of agentic security, and it is what lets enterprises give AI agents the autonomy they need without inheriting unmanaged risk," Eliyahu said.

Shadow systems

The report also highlights concern over what it describes as shadow MCP infrastructure. It found that 32.9% of respondents had discovered an unauthorised, shadow or misconfigured MCP server in the past 12 months, while 54.3% said they had either confirmed or suspected one.

Salt Labs, the company's research arm, independently found MCP-related infrastructure in 21.6% of customer environments in August 2026, compared with 16.7% in January. That represents a relative increase of about 30% in detected prevalence over the period cited in the research.

Another risk area identified in the findings is software produced with help from AI tools. The survey found that 83.5% of respondents estimated that AI-generated or AI-assisted code contributed to at least some of their application security findings.

Only 6.8% said they resolve issues inside the coding assistant at generation time. For the rest, problems tend to surface later during code review, testing or after deployment.

Production risks

Salt linked those findings to earlier research by Salt Labs into the Manus Agentic AI platform. In that work, the research team said a single malicious email could hijack the platform and reach a user's connected email, cloud storage and code repository accounts without a stolen password or a clicked link.

According to Salt, the platform's own guardrail detected the attack but did not stop the malicious code before it ran. It said the example reflects a wider pattern in which detection happens only after an agent has already acted.

"The Manus research and this survey data are two views of the same problem," said Yaniv Balmas, Head of Research at Salt Security.

"In the field, we showed how an agent can be weaponized through a single malicious email, how the guardrail detected the attack at exactly the right moment, and still could not stop the code from running. The survey quantifies how widespread that architecture is. Only 17.5% of organizations can automatically contain a misbehaving agent in production. Manus is one example of what the other 82.5% looks like," Balmas said.

Survey respondents came from security, technology, architecture, application security, API platform and DevOps roles. The largest sector represented was technology at 35%, followed by financial services and insurance at 16.7%, with healthcare and manufacturing each at 11%.