Forgotten AI agents may still access *sensitive company data*

The sleeping problem

Imagine you gave a temporary worker the keys to the warehouse in March, they did their job for a week and left, and the keys are still on their keyring in October. That is the situation with many AI agents, according to a report from Arrakis Security published in late October 2026 ^[1].

The company examined AI agents across organisations and found that 76% of enabled agents had not run in the past 60 days. These dormant agents still held active credentials to company systems, meaning they could read sensitive data, write to databases and execute workflows without recent oversight ^[1].

The report also found that in 34% of cases, agents could access internal email systems, and in 14% they could execute code ^[1].

Why dormant agents matter

When an AI agent is set up, it is given credentials and permissions to do its job. The credentials do not expire just because the agent stops running. If an employee creates an agent, uses it for a few weeks and then moves on to another project, the agent may still have the access it was given months earlier.

The problem compounds when employees leave the organisation. According to Arrakis, there were cases where agents retained access after their creators had left the company ^[1]. It is not that the agents are running amok; they are just sitting there with the keys to the building.

The auditability gap

Beyond the security risk, there is an auditability question. If an agent has access to systems, and logging of its activity is inadequate or absent, you cannot later show what it did, or that it did nothing.

The AI Act, which will apply to high-risk systems from 2 December 2027 for Annex III systems, requires automatic logging of events over the system's lifetime ^[2]. That duty sits with the provider of the AI system, but an organisation deploying AI agents internally still has a practical need to know what its tools are doing, particularly if they can read customer data or change records.

DORA, which has applied to financial entities since 17 January 2025, requires logging procedures that protect logs against tampering, deletion and unauthorised access ^[3]. If an agent has been dormant for two months and then suddenly runs, the log of what it did becomes important, and the question of whether that log can be trusted follows.

What this means for you

If your organisation uses AI agents, here are a few questions to ask:

• Do you have a list of enabled agents? Not just the ones that ran yesterday, but all the ones with active credentials.
• When did each agent last run? If it has been idle for months, does it still need access?
• What happens when someone leaves? Are their agents deactivated as part of offboarding, or do those agents stay enabled?
• Are agent actions logged? If an agent reads a customer file or changes a record, is there an audit trail, and is that trail protected against later editing?
• Can you show what an agent did six months ago? If a regulator, auditor or customer asks, could you produce a record you can stand behind?

Seal agent actions as they happen

Here, a digital witness fits well. The thing to seal is each instruction to an agent, each tool call it makes and each result, captured as the agent acts.

Say an agent changes a customer's order in your system. At that moment, your logging system can seal a record of the instruction, the tool the agent called and the result it got. The record stays in your systems, but a fingerprint of it goes to WitniumChain through the REST API, the SDK or the MCP server, and you get a witness ID back. To check, months later, you calculate the fingerprint again and compare it. If it matches, the record is exactly what was logged at the time. Change a character and it will not match ^[4].

Sealing the record does not authorise what the agent did or make the action correct. It simply means that the record of what happened, and when, can be checked against a reference nobody, including Witnium, can quietly change afterwards.

Anyone who needs to verify the record can do so: internal audit, a supervisor, a customer or your own team trying to reconstruct what went wrong. The first 2,000 witnesses a month are free ^[4].

How it would work

1. Your agent orchestration layer logs each instruction, tool call and result.
2. At each action, a fingerprint of the log entry is sealed through WitniumChain.
3. Later, when someone questions what the agent did, you recalculate the fingerprint and check it against the sealed one.

What to watch

The AI Act's logging requirements for high-risk systems come into force on 2 December 2027 for Annex III systems and on 2 August 2028 for Annex I systems ^[2]. DORA's technical standards on ICT risk management, including the requirement to protect logs against tampering, have applied since 17 January 2025 ^[3].

If you are deploying AI agents in a regulated sector, those dates and duties are worth keeping in mind. The Arrakis report is a reminder that the question is not just what your agents can do, but whether you can show what they actually did.