Companies are giving AI agents access before they can trace or stop them, Salt Labs data shows
Salt Labs found 49.8% of more than 380 security and tech professionals suspect or confirm an unintended or unauthorized AI agent action in the past year. Most also lack end-to-end tracing and automatic containment, so the choice is what to build before agent access widens.
The Board Room · Leadership desk
Key figures from the Salt Labs survey: 86% of organizations surveyed use at least one AI agent. 12.5% of respondents can consistently trace a complete agent path across all agents. 17.5% can automatically stop an agent behaving unexpectedly in production; most can intervene only manually.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Organizations surveyed using at least one AI agent | 86% | 9 | |
| Can consistently trace a complete agent path | 12.5% | across all agents | 4 |
| Can automatically stop an agent in production | 17.5% | most can intervene only manually | 6 |
What happened
- Of those respondents, more than half reported an unauthorized external API call or transaction, and more than four in ten reported an agent modified or deleted data.
- Only 12.5% said they can consistently trace a complete agent path from initial instruction through tools and APIs to outcome.
- Automatic shutdown of a misbehaving production agent is available to just 17.5%; most can intervene only manually or by taking the application offline.
- Salt Labs' own telemetry found MCP-related infrastructure in 22% of customer environments in August, up from 16.7% in January.
Why it matters
- decision Widening what agents can reach is now a sequencing call: trace and automatic stop either exist before the grant, or the first incident is handled by hand.
- exposure Over-broad access sets the ceiling on what a misbehaving agent can touch, and a separate Aembit-commissioned survey found nearly three-quarters say agents often get more access than necessary.
- cost Fixes for AI-assisted code mostly land downstream, since only 7% resolve issues in the coding assistant at generation time, so reviewers and testers absorb the rest.
The 49.8% figure combines two groups. Respondents counted if they had confirmed or suspected an agent action that was not intended, expected or authorized, and the 49.8% is one combined number for both [2]. A skeptic would say a suspicion is not an incident. That is fair as far as it goes. The shadow MCP answers show how large the soft category can be: 33% of respondents said they had found an unauthorized, shadow or misconfigured MCP server, while 54% said they had confirmed or suspected one, a gap of 21 percentage points [7][16]. In our view that gap is what thin tracing looks like from the inside, since a team that cannot follow an agent from instruction to outcome can neither confirm an incident nor rule one out [4].
Scale compounds the problem. Of the organizations surveyed, 86% use at least one agent and 60% run more than ten [9]. A sequence that no single team designed has no obvious owner for its trace, and 77% of respondents said their agents chain actions across other agents, tools and APIs in exactly that way [10].
Roey Eliyahu, CEO of Salt Security, framed the result as a sequencing failure. "Organizations are deploying agents and granting them access to enterprise data, APIs, and services before they can trace what those agents are doing or stop them automatically when something goes wrong," he said [11]. He called closing that gap "the discipline of agentic security" [12]. Eliyahu is CEO of Salt Security [13], and the survey carries the Salt Labs name [1], so the survey and the diagnosis arrive together from one source. The report summary does not say how respondents were recruited or how severe the unauthorized actions were.
The decision this quarter is ordering. Widening an agent's reach before full tracing exists means next quarter's incident gets investigated by hand. More than six in ten respondents expect that to take hours or days for a single agent's previous day [5].
What to watch
- Whether Salt Labs or a later survey separates confirmed incidents from suspected ones and reports severity or loss.
- Whether the share able to stop an agent automatically rises while MCP-related infrastructure keeps growing past 22% of environments.
- Whether surveys not commissioned by a security vendor reproduce the finding that agents receive more access than necessary.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption60
- Hype gap+25
- Incentives75
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Salt Labs published a report based on a survey of more than 380 security and technology professionals, along with production telemetry from hundreds of customer environments.
- [2]
49.8% of survey respondents said they had confirmed or suspected that an AI agent in their organization took an action in the past 12 months that was not intended, expected, or authorized.
- [3]
Of those respondents, more than half reported an unauthorized external API call or transaction, and more than four in ten reported that an agent modified or deleted data.
- [4]
Only 12.5% of respondents said they can consistently trace a complete agent path across all agents, from initial instruction through tools and APIs to outcome.
- [5]
More than six in ten respondents believe they would need hours or days of manual work to reconstruct what a specific agent did the previous day.
- [6]
Only 17.5% of respondents can automatically stop an agent that begins behaving unexpectedly in production; most can intervene only manually or by taking the application offline.
- [7]
33% of respondents said they had found an unauthorized, shadow, or misconfigured MCP server in the past 12 months, and 54% said they had confirmed or suspected one.
- [8]
Salt Labs' own data shows MCP-related infrastructure in 22% of customer environments in August this year, up from 16.7% in January.
- [9]
86% of organizations surveyed use at least one AI agent, and 60% run more than ten.
- [10]
77% of respondents said their agents chain actions across other agents, tools, and APIs, in sequences no single team designed in advance.
- [11]
"Organizations are deploying agents and granting them access to enterprise data, APIs, and services before they can trace what those agents are doing or stop them automatically when something goes wrong," said Roey Eliyahu.
- [12]
Eliyahu said: "Closing that gap is the discipline of agentic security, and it is what lets enterprises give AI agents the autonomy they need without inheriting unmanaged risk."
- [13]
Roey Eliyahu is CEO of Salt Security.
- [14]
In an earlier survey commissioned by Aembit, nearly three-quarters of respondents said agents often receive more access than necessary, and 68% said organizations cannot accurately identify AI agent activity compared to human activity.
- [15]
More than eight in ten respondents said AI-generated or AI-assisted code contributes to at least some of their application security findings, and only 7% resolve issues inside the coding assistant at generation time rather than through code review, testing, or after deployment.
- [16]
The gap between respondents who confirmed or suspected a shadow MCP server (54%) and those who found one (33%) is 21 percentage points.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- itpro.comAI agents have a mind of their own – and that’s a problem for businesses
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AI Agent SecurityFollow
- Model Context ProtocolFollow
- Business-team software and IT governanceFollow