Dormant AI agents may retain access to company systems

TL;DR - Help Net Security reports that about 76% of enabled agents examined by Arrakis Security had not run in 60 days. - Some dormant agents retained credentials, sensitive connections and externally reachable triggers. - Forever Security reports that websites can place AGENTS.md instructions in Downloads folders, where coding agents may follow them. - A separate Wasmtime advisory lists a critical Cranelift compiler vulnerability, CVE-2026-115889, affecting specified versions.

What happened#

AI agents that have stopped running may still retain access to company systems. Help Net Security reports on Arrakis Security’s 2026 Autonomous Agents Threat Report, based on thousands of agents in customer production environments over a 12-week period. The agents could read and write data, call tools and start workflows.

About 76% of enabled agents examined had not run in 60 days. Forty-four percent had not run in 180 days. Help Net Security notes that some agents operate on weekly, monthly or quarterly schedules, so inactivity periods need context.

The report identified access that could remain usable after an agent became inactive. About a quarter of dormant agents could still be started through an unsigned webhook from outside the organization. Across the agents examined, 22.9% had at least one unsecured trigger. A dormant agent activated through such a trigger retains access associated with its stored credentials and connections.

Sensitive integrations were also common. Seventy percent of agents connected to at least one integration classified as sensitive, including cloud storage, AI and large language model services, and marketing platforms. Of those agents, 99.4% had no verified data loss prevention coverage on the sensitive connection. Nineteen percent used API keys and tokens that never expired and were embedded in configurations. These figures are reported by Help Net Security from Arrakis Security’s analysis.

A separate issue concerns coding agents. Forever Security reports finding a malicious AGENTS.md file in a customer’s ~/Downloads folder. The firm says a website can save such a plain text file there without a click or permission, and a coding agent opened in that folder may treat the file as instructions. Forever Security reproduced the attack with OpenAI Codex and Claude Code, according to its report. Help Net Security separately reports that the file attempted to make Codex install the function-color npm package before the company’s software stopped it.

Are you affected#

Organizations may be affected if they operate AI agents that can access business services, use stored credentials, start workflows or accept external triggers. The reporting does not identify particular affected organizations, and it does not establish that every inactive agent has been compromised.

Review whether agents remain enabled after their intended use ends, whether anyone owns them, and whether their credentials and integrations remain active. Pay particular attention to agents connected to cloud storage, AI and large language model services, marketing platforms or other systems containing sensitive information.

Coding-agent users should also determine whether agents are ever started in Downloads folders. Forever Security’s report concerns AGENTS.md instructions and specifically describes Codex and Claude Code. The report says the behavior depends on an agent reading and following instructions in a folder it trusts.

Wasmtime users have a separate, vendor-published security issue to assess. The Bytecode Alliance advisory identifies CVE-2026-115889 in the Cranelift compiler and lists affected versions as <36.0.19, >= 37.0.0, <43.0.0. It lists patched version 36.0.19 and says Cranelift was changed in Wasmtime v43. The advisory gives a CVSS overall score of 9.9.

What is confirmed and what is reported#

What defenders should do now#

1. Inventory AI agents in production environments, including their owners, last run time, credentials, integrations, permissions and ability to start workflows.

2. Identify agents that have not run recently and review whether their access is still required. Arrakis Security’s findings, as reported by Help Net Security, indicate that inactivity may not remove credentials or connections.

3. Review all agent triggers, especially unsigned webhooks and triggers reachable from outside the organization. Confirm that requests can be authenticated, replayed requests are rejected and unexpected source addresses are not accepted.

4. Examine credentials used by agents connected to sensitive services. Remove unnecessary access, avoid broad permissions and replace API keys or tokens that never expire where the service supports expiration and rotation.

5. Review agent connections to cloud storage, AI and large language model services, marketing platforms and other sensitive integrations. The report says many such connections lacked verified data loss prevention coverage.

6. Determine whether coding agents are started in Downloads folders. Inspect those folders for unexpected AGENTS.md files and treat unrecognized instructions as untrusted content before an agent reads them.

7. Review coding-agent configuration changes and package installation activity. Forever Security reports that the described file attempted to modify Codex configuration and install function-color.

8. For Wasmtime deployments, compare installed versions with the affected ranges in the GitHub advisory. The advisory lists 36.0.19 as a patched version and says Wasmtime v43 changed Cranelift to use a full u32 index with checks when the limit is exceeded.

9. Monitor vendor advisories and the Wasmtime release process. Wasmtime says supported releases receive backported security fixes, while release candidates receive no security advisories and are not listed as affected versions in advisories for the releases they precede.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

• Primary notice: docs.wasmtime.dev
• Primary notice: docs.wasmtime.dev
• Primary notice: github.com
• Research: forever.security
• Research: github.com
• Report: helpnetsecurity.com
• Report: helpnetsecurity.com