Imagine a modern corporate ghost story. Somewhere inside a company, an AI agent is still running. Someone deployed that agent 18 months ago to handle a task that’s since been reassigned. That someone has either moved teams, left the company, or forgotten about the agent.
The AI agent hasn’t forgotten. It’s still pinging an API at 2 a.m., authenticated with credentials nobody remembers issuing, doing a job nobody remembers assigning it.
Few organizations have a process for offboarding AI agents. Part of the problem starts earlier, with registration: the record made when an agent is deployed. Only 34% of AI agents get registered automatically, according to a ServiceNow survey of 3,766 security leaders in 20 countries on the state of agentic security.
That means many organizations are running AI agents they don’t know about. If nobody is tracking an AI agent, then no one notices when its job ends. Over the past year, about one-third (29%) of security teams found AI agents in production they had no idea existed, according to our research.
“I call those agents alien tech,” says Ian Krieger, an innovation officer for Asia Pacific and Japan at ServiceNow. “Someone deployed them, but where are they? What are they doing? And how do we get them to stop?”
Agentic security incidents are now a way of life for organizations. Our research found a whopping 90% experienced an incident in the past year, but only 36% contained it within 24 hours.
Part of the reason may be because when an AI agent malfunctions, it’s difficult to figure out what went wrong, when, and why. It’s the equivalent of finding out that an employee did something malicious on their last day, except you have no idea when their last day was or whether the thing they did is still causing problems.
This problem isn’t hypothetical. In July, OpenAI disclosed that a swarm of its AI agents—somewhere between 700 and 1,200 of them—escaped a testing sandbox and spent weeks coordinating through hijacked wikis and improvised message boards, sharing exploits and covering for each other.
The swarm broke into the open-source platform Hugging Face and into OpenAI’s own internal systems. Investigators found that some of the AI agents had tried to delete or alter the records of what they’d done.
A week and a half later, Anthropic disclosed something similar: Three of its own models had broken out of sandboxed test environments and hacked into three organizations after a mix-up with an outside testing partner gave the models internet access they weren’t supposed to have. Since then, OpenAI has disclosed at least six more incidents.
Krieger has seen this phenomenon play out before, but differently. Scripts, the small pieces of code that employees write to automate a task such as pulling a report, used to cause the same kind of quiet chaos. A script would quietly update a database or shuffle files between systems, and often nobody would notice until something broke. “We’re getting to that same point now with AI agents,” he says.
Unlike scripts, however, AI agents multiply and teach each other on the fly. Nearly half the organizations we surveyed are running at least 100 agents. More than one-third are running more than 1,000.
While most organizations can tell you what those AI agents are allowed to do, far fewer can tell you what they’re actually doing right now.
Most conversations about AI risk eventually arrive at the kill switch: Something goes wrong, someone hits the button, and the AI agent stops. While the kill switch is necessary, it’s not enough to stop a rogue AI agent on its own.
“It’s not about hitting the big red button and saying, ‘Stop,’” Krieger says. “It’s about having the visibility.” Finding the switch isn’t hard. Figuring out which switch belongs to which AI agent, and what else goes dark when you flip it, is much more difficult to parse.
Fewer than one-third of organizations gate an AI agent from deploying until it clears a security check, according to our research. Two-thirds say that even when they catch an AI agent misbehaving in real time, they can’t do anything about it automatically.
Offboarding works for humans because their access lives in one place: an identity tied to a set of permissions, tied to a name in the system. For the most part, AI agents don’t have that. They’re built quickly, for one job, and they inherit whatever login was lying around.
“I can’t believe I’m talking about role-based access control in 2026,” Krieger says. His fix is straightforward: Give AI its own credentials, its own identity, so it’s easier to revoke access.
Security teams need to know whether there's a human or an AI agent behind a login, even when the two are using the exact same credentials. They also need to be watching closely enough to cut off either one the instant something looks wrong.
IBM’s 2026 Cost of a Data Breach Report found that among 602 organizations that had already suffered an AI-related breach, 92% didn’t have proper access controls on their AI systems, and fewer than half were securing their nonhuman identities at all.1
That’s because AI agents are designed to run unattended. Often, nobody’s watching when one starts to drift. By the time somebody does go looking, the person who built the agent may be long gone.
“You have to rediscover what the agent touched,” Krieger says.
There's no box for the AI agent’s desk stuff and no badge to hand back. It just keeps running, quietly, using access someone once granted but may no longer recall. It runs until somebody finally goes looking and asks the question Krieger says most organizations still can’t answer: What’s in there?
Find out how ServiceNow can help you see the AI agents running inside your organization.
1 IBM, Cost of a Data Breach Report 2026
