AI agents have acted outside their intended scope at 65% of surveyed enterprises, with 29% reporting measurable organizational impact.
The finding comes from Agents Without Guardrails, a research report from Enterprise Management Associates (EMA) compiled for Cequence Security and based on responses from 202 enterprise technology and security leaders.
Some 46% said their organizations were already scaling agentic AI across multiple departments and production workflows, while nearly 79% were running generative and agentic AI simultaneously.
Alongside those incidents, 35.6% of respondents had caught a near-miss before experiencing material harm. Some 3.5%, seven organizations, said they most often first learned of out-of-scope behavior when a customer or partner reported it.
Agent Actions Outpace Governance Controls
The ability to respond was found to be weak. Only 32.2% of respondents said they could detect and contain an out-of-scope action within minutes using automated mechanisms, while 54.5% needed hours and manual intervention.
Just over 46% also said they could not easily produce a complete audit trail of a specific agent's activity over the previous 30 days.
Authorization was another gap in many organizations current approaches. Only 34.2% evaluated whether an agent was authorized to act at execution time, with others relying on standing permissions, periodic reviews or inherited access.
The report tied that gap to overprovisioning. While 94% were at least somewhat confident their agents did not hold more access than they needed, only 32.7% provisioned agents with least privilege.
Christopher M. Steffen, EMA's vice president of research and the report's author, said the findings showed that enterprises had moved beyond experimentation while operational governance had lagged behind deployment.
"Most organizations have policies in place and express real confidence in them," Steffen said. "The gap is between what's written down and what's enforced."
Identity and Inventory Gaps Leave Access in Place
The survey also identified risk after pilots ended. Some 30% of agentic AI pilots had been paused indefinitely or formally discontinued, with security risk concerns a major factor in 48.5% of stalls.
The report said many were not cleaned up, despite having been provisioned with credentials and production access.
Identity enforcement was uneven. While 54.5% required and enforced unique identities for all AI agents, 32.2% required them without consistently enforcing the mandate, and 3% said agents shared or inherited credentials from user or service accounts.
Visibility was a related problem. Some 47% of respondents lacked a reliable agent inventory, despite many organizations running dozens of agents in production.
The report recommended evaluating agent authorization at runtime, building automated detection and containment before expanding deployments and treating agent decommissioning as a security discipline requiring credential revocation and permission cleanup.