Study: 54% of enterprises hit by AI agent security incidents, most lack proper controls
Most agents still share credentials, and only 32% have unique identities — a recipe for disaster.
A new VentureBeat Pulse Research report reveals a critical security gap in enterprise AI agent deployment. Across 107 organizations with over 100 employees, 54% have already experienced a confirmed agent security incident (18%) or a near-miss (36%). The root cause is weak identity management: only 32% give every agent its own scoped, managed identity, while most still rely on shared credentials or API keys. This broadens the blast radius when an agent is compromised. Additionally, only 30% isolate their highest-risk agents in sandboxes, leaving most agents loosely contained.
The security tooling landscape is dominated by native controls from model providers — OpenAI’s guardrails (51%), Google and Microsoft cloud controls, and Anthropic’s managed-agent features — rather than specialized agent-security vendors. Despite a high satisfaction rate (4.2 out of 5), only a third of enterprises believe their AI defenses are ahead of AI-enabled attackers, and a clear majority plan to switch tooling within the year. Spending remains a thin slice of security budgets, and enterprises are evenly split on whether they’re keeping pace. The report underscores a dangerous disconnect: organizations trust their current controls even as they prepare to replace them.
- 54% of enterprises reported an AI agent security incident or near-miss, with 18% confirmed breaches.
- Only 32% give every agent its own scoped identity; most still share credentials or API keys.
- 30% isolate high-risk agents in sandboxes; 51% rely on OpenAI’s guardrails, yet 62% plan to change tooling soon.
Why It Matters
Agent autonomy is outpacing identity and isolation controls — a ticking time bomb for enterprise security.