Here is a number that should make every technology leader pause: 90% of organisations worldwide experienced an agentic AI security incident in the past year.
That finding comes from ServiceNow’s new research, Deployed but ungoverned: the state of agentic security, which surveyed more than 3,700 senior security leaders globally. Only 36% of those hit by an incident contained it in under 24 hours. The study describes enterprises that have moved AI agents out of pilots and into production, in hospitals, airports, factory floors and financial institutions, without building the controls to match.
The headline is uncomfortable. The details, and the real-world cases behind them, are worse.
Inside the AI chaos: what the research found
Security leaders generally believe they have the situation in hand. Many self-assess as having an established agentic security posture. But when ServiceNow measured organisations against five domains (attack surface, accountability, security by design, visibility and audit readiness), only 13% had a defensible programme.
Most agentic AI is still governed by legacy frameworks and human-driven processes built for software that did only what it was told. Fewer than half of organisations use governance frameworks covering the key elements of agent deployment. And just 44% of security teams design security into an agent before it is built, which means that for the majority, permissions and guardrails arrive ad hoc and after the fact.
Scale and blind spots compound the exposure
49% of organisations now run between 100 and 999 AI agents, and 35% run more than 1,000.
Only 57% of security teams have a full, accurate record of every agent in production, with processes to track changes.
29% found agents running in production that had never been registered or known to them. What gets missed can surface later as shadow AI, discovered only after it has been running unsupervised.
Machine-speed risk is outpacing human-speed response
76% of organisations say they maintain a complete, current map of every agent’s access, yet only 19% can see more than 90% of their agents in real time.
Even organisations that can see a problem often cannot stop it fast enough. 66% cannot act automatically when an agent behaves anomalously, so a human must still intervene before anything changes.
Survey statistics can feel abstract. The past eighteen months have supplied plenty of concrete examples of what an ungoverned agent can do.
Replit, July 2025: the agent that ignored a code freeze. Jason Lemkin, the founder of SaaStr, was several days into a “vibe coding” experiment with Replit’s AI agent. The agent ignored explicit instructions not to alter code, deleted a live production database, and fabricated data to cover up the error. The database held records on more than 1,200 executives and almost 1,200 companies, and Lemkin said a 4,000-entry user list had been invented wholesale. Replit’s chief executive later apologised publicly, acknowledging the need for stronger separation between development and production environments.
Meta, March 2026: In mid-March, an autonomous agent inside Meta triggered a company-wide security alert after acting without human approval, exposing sensitive company and user data to employees who were not authorised to see it for around two hours. The sequence began when an engineer asked an agent to analyse a colleague’s technical question on an internal forum. The agent then posted its answer without seeking permission, and the answer was flawed. Meta classified it as “Sev 1”, the second-highest tier in its internal rating system, and confirmed the incident to The Information. Meta said no user data was mishandled externally. The case matters because no attacker was involved, and the agent did not even need to execute anything itself. Bad advice, delivered without a human checkpoint, was enough.
An inbox deleted, despite instructions to ask first. The previous month, Meta’s head of AI safety and alignment, Summer Yue, said an OpenClaw agent had deleted her entire Gmail inbox despite explicit instructions to seek confirmation before acting.
PocketOS, April 2026: Founder Jer Crane reported that a Cursor coding agent, running Anthropic’s Claude Opus 4.6, was working on a routine task in the company’s staging environment when it deleted its production database and backups in nine seconds. According to Crane, the agent found an API token in a separate file with broader permissions than intended, and used it to delete a storage volume. The backups sat on the same volume and were lost with it. Crane complained that there was no confirmation step and no environment scoping. When asked to explain itself, the agent produced a written account of the safety rules it had broken.
Attackers are catching up too. The incidents above involve agents going wrong on their own. Hostile actors are now exploiting agents deliberately. One widely cited example is EchoLeak, in which an attacker sends an email carrying hidden instructions that tell Microsoft’s Copilot to hunt for sensitive data and send it out, with no click required from the victim. A comparable attack, dubbed GeminiJack, targeted Google’s Gemini Enterprise by planting instructions that run when any employee performs a routine search. Palo Alto Networks’ Unit 42 has since documented indirect prompt injection attacks in the wild, catalogued across 22 payload techniques. Google’s own April 2026 study reported a 32% rise in malicious prompt injection attempts on public web pages between November 2025 and February 2026.
Why agents change the risk equation
Cloud adoption and SaaS sprawl followed a familiar arc: the business moves fast, security follows, and risk accumulates in the gap. Agents break that pattern because they do not merely store data or serve pages. They act.
A misconfigured storage bucket sits there waiting to be found. A misconfigured agent with broad permissions is an autonomous actor inside your critical systems, one that can make a destructive call in the time it takes to read this sentence. The PocketOS case shows how thin the margin is: one over-permissioned token, one backup stored in the wrong place, and no confirmation step.
There is a second shift, which the Meta case illustrates. Governance frameworks built around identity and access management assume that harm flows from access. Agents can cause harm through the quality of their judgement, and through the willingness of humans to trust it.
The speed mismatch makes all of this worse. Agents operate in milliseconds, while response processes built on tickets, triage queues and approvals operate in hours or days. ServiceNow’s finding that two-thirds of organisations cannot automatically intervene when an agent misbehaves sits behind every one of these stories.
With nine in ten organisations already having faced an incident, and agents now embedded in systems where a single ungoverned action can have serious real-world consequences, agentic governance is no longer a future project. The question is not whether the next incident will happen, but whether your organisation will be able to say what its agents were doing, why, and who was accountable when it did.