Half of firms have already lived the version of agent risk that no identity check, by itself, can stop.

Salt Security reports that 49.8 percent of respondents confirmed or suspected that an AI agent in their organization took an action in the past year that was not intended, expected, or authorized. Among that group, more than half reported an unauthorized external API call or transaction, and more than 40 percent reported an agent modifying or deleting data.

That is not a story about a stranger breaking in. It is a story about an authorized agent taking an unauthorized step.

Adoption has outrun tracing

The same report puts the scale in plain terms. 86.4 percent of respondents report at least one AI agent operating in their organization, and 59.5 percent run more than ten.…