The agent nobody remembers deploying
Humanbound's engine and CLI are open source: github.com/humanbound/humanbound Arrakis Security's report, covered by Help Net Security on 26 October, found about 76% of enabled agents in production had not run in 60 days
Humanbound's engine and CLI are open source: github.com/humanbound/humanbound
Arrakis Security's report, covered by Help Net Security on 26 October, found about 76% of enabled agents in production had not run in 60 days, and many still hold live credentials. The agent nobody remembers deploying is not idle. It is an unmonitored identity with access, and nobody owns the job of switching it off.
The numbers
Arrakis analysed thousands of agents in customer production environments over roughly three months. These are vendor figures, so read them as one data set rather than an industry census, but they are specific:
- About 76% of enabled agents had not run in 60 days, and 44% had not run in 180 days.
- About a quarter of dormant agents could be started through an unsigned webhook.
- 22.9% of all agents had at least one unsecured trigger.
- 70% connected to at least one sensitive integration, and 99.4% of those lacked verified DLP coverage.
- 19% used API keys or tokens that never expire.
Arrakis CEO Tal Baron gave the root cause in one line: when an agent stops being used, nobody removes anything, because in most companies nobody owns it.
Why dormant is not the same as safe
A forgotten agent keeps three things: its credentials, its integrations and its triggers. An unsigned webhook turns an agent nobody has run since spring into an entry point anyone who finds the URL can start. A token that never expires turns a retired prototype into a standing key.
Agents also delegate. The Arrakis report notes that an agent can hand work to other agents or third-party models and receive output produced under another agent's permissions, so one forgotten link can sit inside a chain that still looks active.
Keys you cannot revoke
The OpenCode breach, reported by BleepingComputer on 19 October, shows the cost of keys parked in places you do not control. Stored provider keys were exposed from 17 October at the earliest, about 1.4% of Console users were affected, and some reported overnight charges of up to $1,700 (the company's account is provisional). A key an agent platform holds for you is only as revocable as that platform and the provider allow.
Identity is the way to find them
The NIST, CISA and NSA guide published on 16 October offers ten voluntary practices for responding when agents act without direction. In a sponsored BleepingComputer piece on 26 October, BeyondTrust's Len Noe argues the practical question in an incident is not intent but identity: which identity acted, and with what authority. If every agent has its own identity, a forgotten one shows up as an identity nobody uses and nobody owns.
A short cleanup list
- Inventory every agent, including the ones nobody has run in 60 days.
- Assign a named owner to each, or retire it.
- Replace never-expiring keys with task-scoped, expiring credentials.
- Sign or remove every webhook trigger.
- Test what a dormant agent can still reach if someone starts it.
Test your own agents
Sign up for Humanbound's free Community plan at https://app.humanbound.ai and run adversarial tests against the agents you know about, then go find the ones you do not.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.