Dormant AI Agents Retain Excessive Access, Posing Silent Data Risk
Written by AI from the linked story. Not reviewed by an editor. How this works
Organizations are deploying AI agents with broad permissions and long-lived API keys, then forgetting about them — leaving 76% idle for over 60 days while still holding valid credentials to sensitive systems. This 'ghost agent' problem mirrors the classic challenge of orphaned service accounts, but with the added risk of unsecured triggers that allow external actors to reactivate dormant agents and initiate actions like data exfiltration. The lack of data loss prevention coverage over these agent connections compounds the exposure. This matters because attackers increasingly target non-human identities, which are often overlooked in access reviews and lack the same scrutiny as human user accounts.
Tactical Insight
Immediate actions
- Audit all deployed AI agents and revoke credentials or API keys for any agent inactive for more than 30 days.
- Disable or sandbox unsecured triggers on dormant agents until a formal review confirms they are still required.
Long-term improvements
- Enforce least-privilege principles for all AI agent identities, scoping permissions to only the resources and actions each agent strictly requires.
- Implement mandatory expiry and automated rotation for all API keys and credentials issued to AI agents.
- Maintain a living inventory of all non-human identities (AI agents, service accounts, bots) with documented owners, purposes, and last-active timestamps.
Detection measures
- Apply data loss prevention (DLP) policies to all data paths accessible by AI agents, alerting on anomalous data movement.
- Configure logging and alerting for any reactivation of agents that have been dormant beyond a defined threshold, treating it as a potential security event.