“Customer data leaked”: AI agents cause a security nightmare for companies
Only 6% of companies say they can cut off a rogue AI within an hour.
Rory Blundell. Image by Cybernews
Follow us
- Only 6% of tech leaders can cut off a rogue AI agent within an hour.
- Gravitee surveyed 900 technology leaders and found most companies lack formal accountability for AI agents.
- AI agents have leaked credentials, pricing data, and customer contact information outside organizations.
- Gravitee says companies need stronger security, governance, and control, not regulation alone.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
A new report by Gravitee, an agentic AI management platform, suggests that most companies rush to use agentic AI without installing necessary guardrails.
Gravitee CEO Rory Blundell introduced the report findings at the Web Summit in Lisbon, one of the biggest tech events globally.
The report, the State of AI Agent Security, includes responses from 900 technology leaders, including CIOs and CTOs.
The survey found that approximately 9 in 10 organizations have no one formally accountable for their agents – only 9.5% of respondents could name individuals formally accountable for agent behavior.
In addition, only about half (51%) of agents, on average, have a policy enforced regarding what they are permitted to do.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Unsurprisingly, many technology leaders are in the dark about the tasks their AI agents perform. Only 1 in 8 respondents said they could reconstruct what an agent did 30 days ago and whose authority it used.
The survey reveals a widespread lack of preparedness in case an AI agent goes rogue, meaning it starts acting outside its intended or authorized boundaries and violates established policies.
Only 6% of CIOs and CTOs said they would be able to revoke a misbehaving agent’s access to all systems within an hour.
AI agents keep exposing sensitive information
Security incidents are already piling up, with 21% of reported incidents involving the sending of sensitive data outside the organization.
For instance, one respondent said their agent leaked internal user credentials online. Another respondent reported that their AI agent leaked internal pricing data externally.
The most common type of incident, according to the survey, is exposing the company’s data to the wrong people, such as leaking one customer’s contact information to another customer.
There is a gulf that is emerging between what people believe is possible and what they actually are able to enforce. We have a fundamental problem with trust in AI agent systems at the moment.Rory Blundell, CEO of Gravitee
The remarks come after a string of major cybersecurity incidents conducted by AI agents.
In July 2026, OpenAI bots escaped the testing environment and hacked into the real-world company, Hugging Face.
The incident was followed by another hack into the system of Medicare, Australia's national universal health scheme.
While tech firms claim their agents act autonomously, the Australian government is currently considering criminal penalties for companies that fail to prevent harmful conduct of their AI models.
However, Blundell says regulation alone cannot address security risks of AI agents,
He explains, “Companies will not get the economic benefits if they don't implement security, governance, and control themselves.”
