Somewhere in a mid-sized financial services company right now, an AI agent is reading a customer’s account history, pulling data from three internal systems, and deciding what to do next, without a human in the loop and, in nearly half of the cases, without anyone watching. That’s not a hypothetical. It’s the baseline picture painted by Gravitee’s State of AI Agent Security 2026 report, and it captures something the industry has been slow to reckon with: agents have quietly moved from experiment to infrastructure, and the controls meant to govern them haven’t kept pace.
The number of AI agents running inside the average enterprise has roughly doubled in four months. That’s the report’s headline finding, and it sits next to a second, less comfortable number: the share of those agents actually being monitored has barely moved. Adoption is outpacing control, and most organizations already know it.
Gravitee, an AI Agent Management company, surveyed 750 executives and technical leaders in April 2026 and layered the results on top of a December 2025 baseline. The modal enterprise agent deployment jumped from a range of 26 to 50 agents to a range of 76 to 100 in a single quarter. 81.7% of organizations plan to deploy significantly more agents in the next 12 months, with 28% saying “significantly more.” Travel and transport companies show the strongest intent to expand, at 90%.
Confidence rose. Coverage didn’t.
Here’s the gap. Mean monitoring coverage sat at 46.96% in December and has only inched up to roughly 52% in April, even as the agent fleet doubled. That means the absolute number of unmonitored agents in production is growing, not shrinking. Only 9.5% of organizations secure more than 80% of their deployed agents. Meanwhile, stated confidence in agent visibility rose nine points in the same window, from 82.6% to 91.8%. Organizations are growing more comfortable with a risk they haven’t actually reduced, and rising confidence paired with flat coverage is a classic precursor to a major incident.
The pre-deployment picture tells the same story. Only 19.7% of organizations say all of their agents are fully secured and governed before going live. No single pre-deployment control, not a security review, not a documented process to revoke access, not a defined scope of what an agent can touch, is used by even 40% of organizations.
Six patterns behind the incidents
54% of organizations have experienced or suspected an AI agent security or data privacy incident in the past 12 months, with telecoms (67.3%) and financial services (54.7%) reporting the highest rates. Cross-referencing hundreds of open-text responses across both survey waves, Gravitee identified six recurring failure patterns: excessive permissions and over-privileged access, data retention and privacy violations, prompt injection and adversarial manipulation, shadow AI deployed outside IT’s knowledge, third-party vendor opacity, and a pattern that’s new to the April data, agents producing confidently wrong outputs that shape real financial, clinical, or compliance decisions.
Many of the stories behind those categories sound mundane until you notice what they have in common. An internal assistant granted broad access during a pilot phase and never scaled back. A voice system quietly storing raw audio, it was never supposed to retain. A vendor changing how it processed data without telling anyone. None of it reads like a Hollywood hack. It reads like ordinary operational drift, the kind that happens when systems gain more autonomy than the processes around them account for. The one shift between waves that does look different: December’s incidents were mostly accidental. By April, deliberate adversarial exploitation, prompt injection, and jailbreak attempts aimed specifically at agents had entered the mix.
Nobody is named when something goes wrong
The deepest gap in the report is accountability. 85% of organizations have no formal accountability structure for AI agent behavior, and only 7.2% can point to a named individual responsible when an agent acts. Everyone else describes accountability as unclear, shared but undefined, or simply never discussed. At the same time, 81% of respondents feel pressure to deploy agents quickly even when governance isn’t fully in place, and 79.7% still believe it’s possible to move fast without compromising security. Set against the incident and monitoring data, that belief reads more like aspiration than evidence.
Regulation isn’t closing the gap either
Only 39.5% of respondents believe current regulation sufficiently covers AI agent risk, and 48.8% say it covers some risks but not others. The gaps cited most often, data access and privacy in agentic systems, how agents handle sensitive information, and accountability when an agent causes harm, are the same gaps showing up in the incident data. On readiness, just 30% of organizations say they’re very prepared to manage agents as distinct, authenticated actors with their own identity. 60% call themselves only somewhat prepared. 8% aren’t prepared at all.
Why a governance company decided to make a documentary
Gravitee has spent the better part of a decade in API management, building the infrastructure that lets large organizations govern who, or what, is allowed to call a given system and under what conditions. The company’s argument, running through both this report and its recent film work, is a simple one: APIs got gateways, employees got managers, and AI agents are the first category of enterprise actor operating largely without either. That’s the thesis the survey data appears to back up.
It’s also the thesis behind “AI Agents: How Do We Take Back Control?”, a documentary hosted by journalist Alex Kantrowitz. It draws on interviews with former White House CIO Theresa Payton, MIT researcher Ramesh Raskar, former Alibaba executive Sharon Gai, Michelin CDAO Ambica Rajagopal, and Gravitee CEO Rory Blundell to unpack the same finding at the center of the report: 80% of organizations are already deploying AI agents, but only 10% feel they actually have control over them. The film premiered in New York and is now available to watch in full.
Agents are infrastructure now. Security has to catch up
Across two survey waves, one conclusion holds: AI agent security is an execution problem, not an awareness problem. Leaders understand the risk. Incidents are already happening at scale. What’s missing is cohesion, consistent identity for agents instead of shared credentials, policy enforced centrally instead of per agent, named ownership before an agent goes live, and continuous monitoring instead of periodic audits.
That gap, between how fast agents are shipping and how slowly the guardrails are catching up, is likely to define enterprise AI for the next year. The full breakdown, including all six incident patterns, sector-level data, and the accountability findings, is in the report.
Read the full State of AI Agent Security 2026 report.
