The Pulse
59% of Organizations Running AI Agents Report Incidents or Near-Misses
In a VentureBeat Intelligence survey, 59% of organizations running AI agents said an agent caused a security incident or near-miss in the past year. The survey also found that shared credentials remain common among organizations with agents
AI.info Team · Written with AI ·
Nearly six in 10 organizations running AI agents say an agent caused a security incident or near-miss in the past year, according to a VentureBeat Intelligence survey published October 5. Thirty percent reported a confirmed incident; 28% said a control caught a near-miss before harm occurred.
64 of 109 organizations running agents reported an incident or near-miss
The survey covered 137 qualified respondents at organizations with at least 100 employees. The incident figures apply to 109 organizations whose agents were in production or in a pilot. Among that group, 37% reported no incident or near-miss.
“We count confirmed incidents and near-misses together, because both are security events caused by an agent.”
— VB Staff, VentureBeat Intelligence
VentureBeat counted respondents who said they did not track incidents, or marked the question not applicable, as neither a confirmed event nor a clean record. Those responses made up 5% of the base. Excluding them would raise the reported incident-or-near-miss share from 59% to 62%, the report says.
The rate was 54% among organizations with agents in production and 66% among those still piloting. VentureBeat said the difference was too close to call. The survey also found no statistically clear change from July, when 55% of organizations running agents reported an incident or near-miss.
Shared credentials complicate accountability
Among organizations with agents in production, only 38% said every agent had its own scoped, managed identity. The remaining 62% said some or all agents used shared API keys, human logins or service-account credentials. Shared credentials can make it harder to trace an action to a specific agent or disable one agent without affecting others, the report says.
Security practices also diverged between stated policy and credential use. Of the production-agent organizations that said they enforced agent permissions at runtime, 59% still reported that some or most agents shared credentials. Only 41% of that group said each agent had its own managed identity.
Just 9% of all respondents said isolating high-risk agents in sandboxes best described their security program. No respondent named a runtime sandboxing tool among the platforms used for agent security.
Most plan new controls, but budgets remain limited
Among organizations running agents that had experienced an incident or near-miss, 91% planned to adopt agent security within 12 months. The equivalent share among organizations reporting neither was 45%. The difference reflects plans, not completed deployments: new controls still need to be selected, tested and connected to existing agents.
Security spending was more restrained. Seventy-six percent of organizations running agents put 10% or less of their security budget toward AI and agent security. The survey’s findings describe respondents’ reported experiences and plans; they do not establish that any particular security provider caused or prevented incidents.
Provider controls lead the security stack
Among 106 organizations that named a primary agent security layer, 40% chose OpenAI’s built-in guardrails and moderation tools, compared with 22% for Microsoft Azure. VentureBeat reported that OpenAI’s share rose from 21% in July, while the share naming Anthropic fell from 26% to 13%. The outlet cautioned that its monthly surveys questioned different respondents.
The survey found that 43% of organizations relying primarily on OpenAI said attackers using AI were ahead of their defenses, compared with 16% of those relying on another primary layer. That result measures respondents’ views, not their actual exposure. VentureBeat said incident rates were too close to call between the OpenAI group and other organizations, and that the survey could not explain why the groups assessed the attacker advantage differently.