Most companies already had an incident with their AI agents — and most of their executives think they're protected

Two truths coexist inside the enterprise this August. The first: nearly every company already has at least one AI agent in production — not as a pilot, but as part of daily operations. The second: the vast majority experienced a security or privacy incident related to those agents in the last year. Two recent studies, with a broad sample of senior technical leaders, document not just massive adoption, but the gap between what executives believe and what actually happens inside their agent stack.

The confidence gap: executives believe they're protected; the logs say otherwise

The most revealing finding in the Gravitee report isn't the incident rate — it's the contrast. Most executives say their policies protect them from unauthorized agent actions. At the same time, most report incidents. Both findings come from the same set of companies. The equation produces the most documented confidence gap of the year in enterprise AI: those defining strategy believe they're covered; those reading the production logs know they're not.

What 'agent sprawl' is — and why nearly every enterprise already has it

Sprawl is what happens when an organization deploys agents without a common framework: different teams build different agents with different tools, no shared standards, no central visibility, no clear owner. Nearly all companies surveyed by OutSystems report they already have it. A sizable share mix homegrown and third-party platform agents without a common governance model — the same situation that produced “shadow IT” in the cloud a decade ago, now repeating with agents. Only a minority have a centralized platform to manage it.

The most dangerous agent isn't the one that fails — it's the one that works unsupervised

Only a minority of companies have real-time visibility into what their agents are doing. In the rest, an agent can make decisions — responding to customers, modifying records, sending information — without anyone being able to review what it did until hours or days later. The risk isn't the agent that answers a query poorly: that failure is visible and gets fixed. The risk is the one that works correctly almost all the time but occasionally acts outside its scope without leaving an auditable trail. Furthermore, only a minority treat their agents as independent identities — the rest assign them the same shared API keys used by the whole team, making it impossible to separate what the agent did from what a person did.

• Independent identity per agent: each agent has its own permissions, not the team's shared API keys — this makes it possible to audit exactly what it did and revoke access if something fails.
• Real-time visibility: someone in the organization reads conversation traces continuously, not retrospectively after a problem has already occurred.
• Formal approval before production: companies that get complete IT and security sign-off before activating an agent report a clearly lower incident rate.
• Named owner: one person with a name and accountability for each agent — not a department, not a support ticket opened after something goes wrong.