A VentureBeat survey reveals significant security gaps in corporate AI agents, with many organizations relying on shared credentials and vendor tools.
A recent survey conducted by VentureBeat has revealed notable security vulnerabilities in corporate AI agents among 107 companies. The findings indicate that 18% of respondents experienced confirmed security incidents, while another 36% faced threats that were averted before any harm occurred. Meanwhile, 42% of participants reported no incidents at all.
Conducted in June 2026, the survey primarily targeted medium-sized businesses with over 100 employees. Interestingly, 5% of the organizations did not have AI agents actively deployed in production, and 2% did not monitor related incidents.
Credential Management Practices
Only a minority, 32%, of respondents reported that each AI agent had its own managed identity with restricted permissions, crucial for effective access control. In contrast, 48% indicated that some agents shared credentials, while 32% operated through shared API keys or employee accounts. This reliance on shared credentials correlates with security incidents; 63.5% of those using shared credentials reported incidents, compared to 40.9% among those with individual agent identities.
To mitigate risks, 49% of organizations restrict permissions for AI agents, and 47% employ monitoring and logging systems, although these may not always prevent dangerous actions. Only 30% isolate the most powerful agents in sandbox environments.
Dependence on Vendor Security Solutions
Security measures primarily stem from built-in tools provided by AI vendors or major cloud platforms, as reported by 82% of participants. Among these, OpenAI's tools were utilized by 51%, followed by Google (36%), Microsoft (35%), and Anthropic (29%). Despite high satisfaction ratings of 4.2 out of 5 for these tools, 59% of respondents plan to enhance or change their security solutions within the next year, with 29% anticipating changes in the next three months.
Notably, 42.1% of organizations that had previously encountered security incidents intend to update their tools shortly, compared to just 14% of those without such experiences.
Survey Insights and Limitations
The survey participants included decision-makers across various levels, with 45% involved in final purchasing decisions. The majority, 67%, represented companies with 101 to 1000 employees, predominantly from technology, manufacturing, retail, and healthcare sectors.
VentureBeat characterized the findings as a preliminary overview, suggesting that as AI agents proliferate, the adoption of robust identity management and access controls has not kept pace. In response to these challenges, Anthropic has recently advocated for a Zero Trust framework, emphasizing individual identities, minimal permissions, and action verification for corporate AI agents.
