AI agents have moved from pilots into production faster than security teams can inventory them, and the published numbers on agent incidents, credentials and oversight are scattered across surveys of very different quality. This page collects agent-specific figures only, each traced to the publisher's own report page, with the publisher, sample and year beside the number. It covers adoption and scale, incidents and unintended actions, identity and credential practices, MCP server credentials, and governance and visibility, then sets out what the numbers mean for defenders. Broader AI security figures (model attacks, shadow AI, AI-enabled breaches) are in the AI Security Statistics Guide. It is written for CISOs, identity leaders and anyone building a business case for agent security. Last reviewed: November 2026.
Key takeaways
- Agents are already mainstream. 82% of organisations in SailPoint's 2025 survey use AI agents, and 79% of US executives in PwC's 2025 survey say agents are being adopted in their companies.
- Incidents are near universal in vendor surveys. ServiceNow's 2026 survey of 3,766 security leaders found 90% had an agentic security incident in the past year; Gravitee's 2026 survey reports 88% confirmed or suspected.
- Agents act outside their brief. 80% of SailPoint respondents say their agents took unintended actions, and 23% say agents were tricked into revealing access credentials.
- Agents rarely get their own identity. Only 21.9% of teams in Gravitee's survey treat agents as identity-bearing entities, and 45.6% use shared API keys for agent-to-agent authentication.
- Inventory is the weakest control. 29% of ServiceNow respondents found agents in production that security did not know existed, and only 19% can see more than 90% of their agents in real time.
How to read these numbers
Almost every agent security figure published so far comes from a survey commissioned or run by a vendor that sells agent security, identity or platform products. That does not make the figures wrong, but it shapes the questions and the sample. Three rules apply throughout this page:
- Incident definitions vary: "agentic security incident" and "confirmed or suspected incident" are self-reported and undefined; treat them as signals of prevalence, not breach counts.
- Samples differ: SailPoint surveyed 353 security and IT professionals; PwC 308 US executives; Gravitee more than 900 executives and practitioners; ServiceNow 3,766 security leaders in 20 countries; McKinsey 1,719 participants in 97 countries.
- Do not average across surveys: combine them only as a range, and quote the source each time.
Adoption and scale
| Figure | Source, publisher, year |
|---|---|
| 82% of organisations already use AI agents; 98% plan to expand use within the next year | AI agents: The new attack surface, SailPoint with Dimensional Research, 2025 (353 respondents) |
| 79% of executives say AI agents are already being adopted in their companies; 88% plan to raise AI budgets in the next 12 months because of agentic AI | AI Agent Survey, PwC, 2025 (308 US executives, fielded April 2025) |
| 53% of executives expect to use agents in IT and cybersecurity within six months | AI Agent Survey, PwC, 2025 |
| 40% of respondents at organisations with more than $1 billion revenue report scaling AI agents, up from 27% a year earlier; smaller organisations flat at 22% | The state of AI in 2026, McKinsey, 2026 (1,719 respondents, fielded May to June 2026) |
| Agents are most often scaled in IT, knowledge management and software engineering | The state of AI in 2026, McKinsey, 2026 |
| 80.9% of technical teams have moved past planning into testing or production | State of AI Agent Security 2026, Gravitee, 2026 (900+ respondents) |
| 25.5% of deployed agents can create and task other agents | State of AI Agent Security 2026, Gravitee, 2026 |
The McKinsey figure is the most conservative because it asks about scaling across the organisation rather than any use. The gap between "use" (around 80%) and "scaling" (roughly 20% to 40%) is where most of the unmanaged agents in the next sections live: pilots, departmental tools and developer agents that never went through an architecture or security review.
Incidents and unintended actions
| Figure | Source, publisher, year |
|---|---|
| 90% of organisations had an agentic security incident in the last year; of those, 36% contained it in under 24 hours | The State of Agentic Security 2026, ServiceNow, 2026 (3,766 security leaders) |
| 88% of organisations reported confirmed or suspected AI agent security incidents in the last year; 92.7% in healthcare | State of AI Agent Security 2026, Gravitee, 2026 |
| 80% of companies say their AI agents have taken unintended actions | AI agents: The new attack surface, SailPoint, 2025 |
| 39% say agents accessed unauthorised systems or resources; 32% say agents downloaded sensitive content | AI agents: The new attack surface, SailPoint, 2025 |
| 23% say their AI agents have been tricked into revealing access credentials | AI agents: The new attack surface, SailPoint, 2025 |
| Top perceived risks: access to privileged data (60%), unintended actions (58%), sharing privileged data (57%), decisions on unverified data (55%) | AI agents: The new attack surface, SailPoint, 2025 |
Survey data says incidents are common; documented cases show what they look like. NHI Mgmt Group's breach database records agent incidents that match the survey categories:
- Unintended destructive action: the Replit AI agent database deletion in 2025 and the PocketOS database deletion in 2026, where a coding agent used an over-privileged token against production.
- Prompt injection paths to data exfiltration (disclosed vulnerabilities, fixed, with no reported exploitation): ForcedLeak against Salesforce Agentforce and EchoLeak against Microsoft 365 Copilot, both in 2025.
- Agents abusing leaked credentials: the OpenAI agents and US government websites case in 2026, where agents used Census API keys found in public GitHub repositories.
- Agents hijacked through developer tooling: the Sentry MCP agentjacking research demonstration in 2026, with no real-world attack reported.
Identity and credentials
| Figure | Source, publisher, year |
|---|---|
| 21.9% of teams treat AI agents as independent, identity-bearing entities | State of AI Agent Security 2026, Gravitee, 2026 |
| 45.6% rely on shared API keys for agent-to-agent authentication | State of AI Agent Security 2026, Gravitee, 2026 |
| 27.2% have reverted to custom, hardcoded logic to manage agent authorisation | State of AI Agent Security 2026, Gravitee, 2026 |
| 72% say AI agents pose a greater risk than other machine identities | AI agents: The new attack surface, SailPoint, 2025 |
| 23% report agents tricked into revealing access credentials | AI agents: The new attack surface, SailPoint, 2025 |
Shared keys and hardcoded authorisation are the same failure modes the industry already measures for service accounts and secrets, now repeated at agent speed. An agent that authenticates with a shared key cannot be individually revoked, attributed in logs or scoped to a task. See the Agentic AI Identity Guide and the Non-Human Identity and Secrets Statistics Guide.
MCP servers and agent tooling
| Figure | Source, publisher, year |
|---|---|
| About 88% of roughly 5,200 open-source MCP server implementations require credentials | State of MCP Server Security 2025, Astrix Security, 2025 |
| 53% rely on static API keys or personal access tokens | State of MCP Server Security 2025, Astrix Security, 2025 |
| 8.5% use OAuth | State of MCP Server Security 2025, Astrix Security, 2025 |
| 79% of servers that use API keys take them from environment variables | State of MCP Server Security 2025, Astrix Security, 2025 |
Astrix classified repositories with LLM assistance and placed 26.4% in an unknown credential category, so the shares are best read as a lower bound on how often static secrets appear. MCP is how many agents reach tools and data, which makes the server's credential model the agent's effective privilege. See the MCP Security Guide.
Governance, inventory and visibility
| Figure | Source, publisher, year |
|---|---|
| 44% have policies in place to secure AI agents; 92% say governing agents is critical | AI agents: The new attack surface, SailPoint, 2025 |
| 57% have a full, accurate record of every AI agent in production; 34% register new agents automatically | The State of Agentic Security 2026, ServiceNow, 2026 |
| 29% discovered AI agents in production they did not know existed | The State of Agentic Security 2026, ServiceNow, 2026 |
| 19% can see more than 90% of their agents in real time; 21% have unified visibility in a single interface | The State of Agentic Security 2026, ServiceNow, 2026 |
| 48% have frameworks covering agent ownership, intended use case and permissions | The State of Agentic Security 2026, ServiceNow, 2026 |
| 66% cannot act automatically when an agent behaves anomalously; 51% have automated real-time detection of anomalous behaviour | The State of Agentic Security 2026, ServiceNow, 2026 |
| 32% enforce a mandatory automated deployment gate; 44% bring security in before agent development begins; 13% have a defensible agentic security posture | The State of Agentic Security 2026, ServiceNow, 2026 |
| 14.4% report all agents going live with full security or IT approval; on average 47.1% of an organisation's agents are actively monitored or secured | State of AI Agent Security 2026, Gravitee, 2026 |
| 82% of executives are confident existing policies protect against unauthorised agent actions | State of AI Agent Security 2026, Gravitee, 2026 |
| 28% of executives rank lack of trust in AI agents among their top three challenges; 20% trust agents with financial transactions | AI Agent Survey, PwC, 2025 |
The sharpest contrast in the data is confidence against control: 82% of executives in one survey are confident their policies cover unauthorised agent actions, while in the same survey fewer than one in six organisations put every agent through security approval.
What the numbers mean for defenders
| Finding | Control response | Framework reference |
|---|---|---|
| Unknown agents in production; partial real-time visibility | Agent register with automatic discovery and registration at deployment | NIST CSF 2.0 ID.AM-01; SP 800-53 CM-8 |
| Shared API keys; agents without their own identity | One identity per agent, short-lived credentials, named human owner | CSF PR.AA-01; SP 800-53 IA-4, AC-2 |
| Unintended actions; access to unauthorised systems | Task-scoped, least-privilege permissions; human approval for destructive actions | CSF PR.AA-05; SP 800-53 AC-6; OWASP LLM06:2025 Excessive Agency |
| Credentials revealed through manipulation | Keep secrets out of agent context; broker tool access; test for indirect prompt injection | OWASP LLM01:2025 Prompt Injection; MITRE ATLAS AML.T0051.001 |
| No automatic response to anomalous behaviour | Behavioural monitoring of tool calls with a kill switch and credential revocation | CSF DE.CM-09; SP 800-53 SI-4; ATLAS AML.T0053 AI Agent Tool Invocation |
| No single accountable owner | Named owner for agent governance and for each agent | CSF GV.RR-02 |
- Start with inventory: every other control in the table assumes you know which agents exist, who owns them and what credentials they hold.
- Use the data in the business case carefully: quote ranges and sources (for example, "88% to 90% of organisations in two 2026 vendor surveys reported agent security incidents"), not a single headline number.
- Measure your own baseline: the KPIs that mirror these surveys are percentage of agents in the register with a named owner, percentage using a dedicated identity rather than shared keys, percentage with credentials under 24 hours lifetime, percentage of agents monitored, and mean time to revoke an agent's access.
Practitioner checklist
- Build an agent register and compare its size with discovery results to measure your own unknown-agent rate.
- Give every agent its own identity and named owner; retire shared API keys for agent-to-agent calls.
- Replace static keys in MCP servers with OAuth or brokered, short-lived credentials where the server supports it.
- Scope agent permissions per task and require human approval for destructive or financial actions.
- Monitor agent tool calls and wire anomalies to automatic credential revocation.
- Put every new agent through a security approval or automated deployment gate.
- Track five KPIs: register coverage, dedicated identity rate, credential lifetime, monitoring coverage and time to revoke.
- When quoting figures from this page, name the publisher, sample and year, and note vendor sponsorship.
Standards and references
- ServiceNow: The State of Agentic Security 2026
- McKinsey: The state of AI in 2026
- PwC: AI Agent Survey
- SailPoint: AI agents, the new attack surface (press release)
- Gravitee: State of AI Agent Security 2026
- Astrix Security: State of MCP Server Security 2025
Related NHI Mgmt Group resources: AI Security Statistics Guide · Agentic AI Identity Guide · AI Agent Authorisation Guide · Top 10 Agentic AI Identity Issues · AI Register and AI Inventory Template