Sixty-five percent of organizations experienced at least one cybersecurity incident caused by AI agents in the past 12 months, according to a Cloud Security Alliance paper published April 21, titled “Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises.” The research was conducted alongside Token Security and reported by Infosecurity Magazine.
The consequences of these incidents: data exposure (61%), operational disruption (43%), unintended actions in business processes (41%), financial losses (35%), and delays in customer-facing or internal services (31%), according to Infosecurity Magazine.
The Visibility Contradiction
The report surfaced a striking gap between confidence and reality. Sixty-eight percent of respondents reported high confidence in their visibility into AI agents operating on their networks. Yet 82% of all respondents said they discovered previously unknown agents in the past year, according to Infosecurity Magazine.
The most common locations for these shadow agents: internal automation environments and large language model platforms, according to Infosecurity Magazine.
“AI agents are outpacing the identity systems meant to secure and control them, and it’s already showing up in unknown agents and real incidents in the enterprise,” said Itamar Apelblat, CEO of Token Security, according to Biometric Update. “These agents are not just another workload. They are a new type of identity and legacy controls don’t work.”
The Decommissioning Problem
Only 21% of organizations have formal processes for decommissioning AI agents, according to ADVISOR Magazine. Agents that have completed their intended purpose may persist on networks while retaining credentials, permissions, or operational hooks. The CSA describes this accumulation as “retirement debt,” warning it creates structural exposure that grows over time, according to Biometric Update.
“As agents gain greater autonomy, governance must evolve into a more unified, operational model that can sustain control at scale,” said Hillary Baron, assistant vice president of research at the Cloud Security Alliance, according to Biometric Update.
From Technical Oversight to Business Risk
The CSA framed the findings as a shift in how organizations must think about agent governance: “Agent behavior must now be integrated into broader security, compliance, and operational resilience strategies rather than managed as an isolated automation challenge,” according to Infosecurity Magazine.
The alliance recommended organizations maintain visibility across all agents including those in SaaS platforms and LLM environments, define and document each agent’s intended function, apply lifecycle governance consistently from onboarding through decommissioning, and evaluate agents against the same risk frameworks applied to other enterprise systems.