Gravitee survey: 52% of firms report AI agent security or privacy incidents in the past year
A new Gravitee report, the State of AI Agent Security third wave, surveyed 900 senior technology leaders in the UK and US and found that 52% of organisations had an AI agent-related security or privacy incident in the previous 12 months. Governance is lagging deployment: only 17% assign an individual identity to every agent, fewer than one in ten have formally designated someone responsible, and just 6% could revoke a rogue agent's access within an hour. The estate is growing quickly, with the share of organisations running more than 150 agents rising from 7% to 16% since April 2026, while the share describing themselves as very prepared for an agent incident fell from 47% to 29%. The findings describe an accountability and oversight problem rather than a specific vulnerability, so no CVE, exploit, malware or threat actor is involved and the urgency is moderate.
Detalhes técnicos
- 97% of respondents run agents able to communicate with other agents, and 40% connect to agents belonging to external organisations, yet only 27% have clear accountability across those interaction chains (gravitee.io via digit.fyi).
- On average, policies on permitted activities are enforced on only 51% of agents, and only one in eight organisations can fully reconstruct an agent's actions from 30 days earlier (digit.fyi).
- 58% of respondents had to revoke an agent's access during a live incident, but only 25% then held an identified individual accountable and 17% made no changes afterwards (digit.fyi).
- Financial services reported the highest incident rate (66%), with 44% uncertain about accountability; healthcare reported 63%, including exposure of patient data (digit.fyi).
- Government and public sector organisations run some of the largest deployments, with a quarter running more than 150 agents, yet only 8.8% can fully reconstruct agent actions (digit.fyi).
- Telecommunications organisations show 21% with a documented procedure for suspending or withdrawing an agent's access (digit.fyi).
- Confidence in regulation fell to 26%, from 40% in April 2026 (digit.fyi).
Remediação
- Gravitee proposes an Agent Accountability Framework that the article describes as built on six principles: Identity, Sponsor, Role, Authority, Oversight and Recourse. These are intended to show which agent acted, under which permissions, who is responsible and how it can be stopped (digit.fyi).
- Gravitee's own release on its framework lists five principles (Identity, Role, Authority, Oversight and Recourse), without Sponsor (manilatimes.net, GlobeNewswire release).
- The research and this framework are vendor-published and no CVE or patch applies; defenders should treat the six or five principles as a governance checklist to verify against their own agent inventories.
Linha do tempo
-
Gravitee survey: 52% of firms report AI agent security or privacy incidents in the past year
ler a análise desta fonte ocultar
A new Gravitee report, the State of AI Agent Security third wave, surveyed 900 senior technology leaders in the UK and US and found that 52% of organisations had an AI agent-related security or privacy incident in the previous 12 months. Governance is lagging deployment: only 17% assign an individual identity to every agent, fewer than one in ten have formally designated someone responsible, and just 6% could revoke a rogue agent's access within an hour. The estate is growing quickly, with the share of organisations running more than 150 agents rising from 7% to 16% since April 2026, while the share describing themselves as very prepared for an agent incident fell from 47% to 29%. The findings describe an accountability and oversight problem rather than a specific vulnerability, so no CVE, exploit, malware or threat actor is involved and the urgency is moderate.
Technical Details
- 97% of respondents run agents able to communicate with other agents, and 40% connect to agents belonging to external organisations, yet only 27% have clear accountability across those interaction chains (gravitee.io via digit.fyi).
- On average, policies on permitted activities are enforced on only 51% of agents, and only one in eight organisations can fully reconstruct an agent's actions from 30 days earlier (digit.fyi).
- 58% of respondents had to revoke an agent's access during a live incident, but only 25% then held an identified individual accountable and 17% made no changes afterwards (digit.fyi).
- Financial services reported the highest incident rate (66%), with 44% uncertain about accountability; healthcare reported 63%, including exposure of patient data (digit.fyi).
- Government and public sector organisations run some of the largest deployments, with a quarter running more than 150 agents, yet only 8.8% can fully reconstruct agent actions (digit.fyi).
- Telecommunications organisations show 21% with a documented procedure for suspending or withdrawing an agent's access (digit.fyi).
- Confidence in regulation fell to 26%, from 40% in April 2026 (digit.fyi).
Remediation
- Gravitee proposes an Agent Accountability Framework that the article describes as built on six principles: Identity, Sponsor, Role, Authority, Oversight and Recourse. These are intended to show which agent acted, under which permissions, who is responsible and how it can be stopped (digit.fyi).
- Gravitee's own release on its framework lists five principles (Identity, Role, Authority, Oversight and Recourse), without Sponsor (manilatimes.net, GlobeNewswire release).
- The research and this framework are vendor-published and no CVE or patch applies; defenders should treat the six or five principles as a governance checklist to verify against their own agent inventories.