Cloud Security Alliance: 82% of enterprises have unknown AI agents

Most companies think they can see their AI agents. The survey from the Cloud Security Alliance says otherwise: 82% of respondents said they found unknown agents in their IT environment over the past year, while 68% still rated their visibility as strong.

That gap matters because the problems are no longer theoretical. Sixty-five percent said they had at least one AI agent-related incident in the last 12 months. The fallout was concrete: 61% reported data exposure, 43% operational disruption, and 35% financial losses.

The ugly part is what happens when agents are left to rot. Only 21% of respondents have formal decommissioning processes, which leaves old agents hanging around with permissions and credentials long after they should’ve been shut down. CSA calls that “retirement debt,” and it’s a tidy phrase for a messy security problem.

The report also suggests companies are not handing over the keys to full autonomy. More than half, 53%, let agents run on their own only for low-risk tasks, with humans reviewing the risky stuff. Just 13% said they use fully autonomous models, and only 11% automatically block actions that go too far.

The survey, commissioned by Token Security, was based on 418 responses from IT and security professionals gathered online in January 2026. It also points to where the blind spots hide: internal automation and scripting environments, LLM platforms, SaaS tools with built-in automation, and developer-created workflows. The pattern is clear enough. The industry keeps talking about controlling AI agents, but many organizations still can’t reliably tell where they are.