54% of Enterprises Report AI Agent Security Incidents, Most Still Let Agents Share Credentials, Survey Finds

A new survey of 107 enterprises has exposed a widening security gap in enterprise AI agent deployments. According to VentureBeat’s report, 54% of organizations have already experienced a confirmed AI agent security incident or near-miss, while security controls lag significantly behind deployment velocity.

The core finding centers on identity and access management gaps. Only about one-third of enterprises give every AI agent its own scoped identity, according to the report. Most agents still operate under shared credentials, meaning a single compromised agent could enable lateral movement and broader data access.

Another striking finding: only three in ten enterprises isolate their highest-risk agents. Most agents run on the same network and system environments as regular applications and employees, expanding the attack surface.

The report also found that enterprise security stacks are overwhelmingly borrowed from model providers and cloud hyperscalers rather than purpose-built for agent-specific threats. This borrowing model may work when agent counts are low, but becomes increasingly inadequate as deployments scale.

AI agents differ fundamentally from traditional software applications: they exercise autonomous decision-making and action capabilities, executing multi-step tasks and calling external tools without human intervention. This autonomy is their value proposition — but it also introduces new security challenges that traditional IAM models and network segmentation strategies were not designed to address.

The report recommends immediate action: create independent service identities for each agent, enforce least-privilege policies, deploy network isolation for high-risk agents, and establish behavioral monitoring tailored to agent activity patterns. Rapid agent deployment without synchronized security hardening exposes organizations to significant risk.