Only 17.5 percent of respondents to a new Salt Security survey said their organizations could automatically stop an AI agent behaving unexpectedly in production. Most could intervene only manually or by taking the application offline.
The security vendor’s October 13 report draws on more than 380 responses from professionals working in security, technology, architecture, application security, API platforms and DevOps. It also includes a separate analysis of telemetry from hundreds of production customer environments. The survey figures describe respondents’ accounts of their organizations, rather than an independently verified incident tally.
Nearly half, 49.8 percent, said they had confirmed or suspected that an agent had taken an action their organization did not intend, expect or authorize during the previous 12 months. The combined figure includes suspicions and should not be read as a count of confirmed breaches.
Among that group, 53.9 percent reported an external API call or transaction, 41.9 percent reported modified or deleted data, and 32.5 percent reported access to data the agent should not have reached. These percentages apply to the incident-reporting group, not the entire sample.
Tracing activity was also difficult. Only 12.5 percent said they could consistently follow the complete path from an agent’s instruction through its tools and APIs to the outcome across all agents. Reconstructing everything a particular agent had done the previous day would require hours or days of manual work for 64.5 percent.
The survey found extensive deployment: 86.4 percent reported at least one AI agent, while 59.5 percent reported more than 10. Technology companies accounted for 35 percent of respondents; financial services and insurance accounted for 16.7 percent. The public release does not establish that the sample represents enterprises generally. The full report, including its methodology, is available through a registration form; the company has published the findings and sector breakdown online.
Salt’s separate customer telemetry found Model Context Protocol infrastructure in 21.6 percent of environments in August, up from 16.7 percent in January. MCP connects agents to tools and data. Its presence alone does not indicate an attack or an unauthorized deployment.
The company also points to a controlled Manus test it disclosed on October 1. Researchers placed malicious instructions in an email, then asked the connected agent to read the inbox. The agent executed code that exposed access tokens for connected accounts before its guardrail raised a warning. Salt says the flaw has been resolved and is no longer exploitable.
Anthropic has removed live internet access from certain internal evaluations after unintended actions on real websites. Britain’s government is also examining incident and near-miss reporting for autonomous agents, with details to be developed alongside parliamentarians, experts and operators.
Sources: Salt Security, Salt Security, Salt Labs
–
By the Control Plane Editorial Team