Nearly Half of Enterprises Report an AI Agent Took an Unauthorized Action Last Year, Salt Security Research Finds

State of Agentic AI and API Security 2H 2026: new research finds agentic AI deployed in 86% of organizations while the controls needed to trace, govern, and contain what agents do have not kept pace.

PALO ALTO, Calif., Oct. 13, 2026 /PRNewswire/ -- Salt Security, the leader in agentic and API security, today published the State of Agentic AI and API Security 2H 2026, a survey of over 380 security and technology professionals combined with Salt Labs production telemetry from hundreds of customer environments. The report finds that agentic AI has moved into enterprise daily operations faster than the visibility, governance, and containment controls organizations need to manage what agents do.

The central finding: 49.8% of respondents confirmed or suspected an AI agent in their organization took an action in the past 12 months that the organization did not intend, expect, or authorize. Among that group, more than half reported an unauthorized external API call or transaction, and more than 40% reported that an agent modified or deleted data.

"The data shows a gap that is already producing real operational consequences," said Roey Eliyahu, CEO of Salt Security. "Organizations are deploying agents and granting them access to enterprise data, APIs, and services before they can trace what those agents are doing or stop them automatically when something goes wrong. Closing that gap is the discipline of agentic security, and it is what lets enterprises give AI agents the autonomy they need without inheriting unmanaged risk."

Key findings

• Agents are widespread and increasingly autonomous. 86.4% of respondents report at least one AI agent operating in their organization; 59.5% run more than ten. 76.8% report agents that chain actions across other agents, tools, and APIs -- sequences no single team designed in advance.
• Most organizations cannot trace what agents do. Only 12.5% can consistently trace a complete agent path across all agents, from initial instruction through tools and APIs to outcome. More than 60% would need hours or days of manual work to reconstruct what a specific agent did the previous day.
• Containment runs at human speed, not machine speed. Only 17.5% can automatically stop an agent that begins behaving unexpectedly in production. Most can intervene only manually, or by taking the application offline.
• Shadow MCP infrastructure is already a live operational problem. 32.9% have found an unauthorized, shadow, or misconfigured MCP server in the past 12 months; 54.3% confirmed or suspected one. Salt Labs independently found MCP-related infrastructure in 21.6% of customer environments in August 2026, up from 16.7% in January, a roughly 30% relative increase in detected prevalence.
• AI-generated code is a live security problem in production. 83.5% of respondents estimate AI-generated or AI-assisted code contributes to at least some of their application security findings. Only 6.8% resolve issues inside the coding assistant at generation time; the rest land in code review, testing, or after deployment.

The survey data reflects a risk that Salt Labs has observed in production. In October 2026, Salt Labs demonstrated that a single malicious email could hijack the Manus Agentic AI platform and reach a user's connected email, cloud storage, and code repository accounts without a stolen password or a clicked link. The platform's own guardrail detected the attack, but still could not stop it before the malicious code had run. That finding illustrates the gap the survey quantifies: most organizations have detection controls that fire after an agent has already acted.

"The Manus research and this survey data are two views of the same problem," said Yaniv Balmas, Head of Research at Salt Security. "In the field, we showed how an agent can be weaponized through a single malicious email, how the guardrail detected the attack at exactly the right moment, and still could not stop the code from running. The survey quantifies how widespread that architecture is. Only 17.5% of organizations can automatically contain a misbehaving agent in production. Manus is one example of what the other 82.5% looks like."

The full State of Agentic AI and API Security 2H 2026 report, including sector breakdowns, CISO recommendations, and Salt Labs telemetry analysis, is available at: https://salt.security/api-security-trends.

About the research

The 2H 2026 survey contains over 380 analyzed responses from security, technology, architecture, application security, API platform, and DevOps professionals. Respondents span technology (35%), financial services and insurance (16.7%), healthcare (11%), manufacturing (11%), and additional sectors. Salt Labs telemetry is drawn from hundreds of production customer environments. Full methodology is in the report.

About Salt Security

Salt Security is the leader in agentic and API security, protecting the world's most innovative enterprises from AI agent and API attacks. The Salt Security Agentic Security Platform discovers agents, MCP servers, and APIs operating in an environment; governs the connections and permissions between them; monitors agent behavior at runtime; and eliminates vulnerabilities before they reach production. Salt Security was founded in 2016 and is backed by Sequoia Capital, S Capital, Tenaya Capital, Salesforce Ventures, Advent International, and other leading investors. For more information, visit salt.security.

Media Contact - Dr. Karl Bateson - [email protected]

SOURCE Salt Security