What the 2026 data says about AI agents acting without authority
Surveys, incidents and new guidance point to one gap: agents with valid access taking actions nobody authorised, and organisations unable to show what happened.
For most of 2024 and 2025, the worry about AI agents was hypothetical: what might happen if an agent did something it should not? In 2026 the question changed. Organisations now report that it has happened, and they are finding out how little they can show about it afterwards.
This article pulls together what the year's surveys, incidents and guidance say, what they have in common, and what it means for anyone letting agents act on real systems.
What organisations report
Three surveys published this year asked security and engineering teams about agents in their own environments.
In an October survey of more than 380 security, architecture and platform professionals, just under half said they had confirmed or suspected that an agent took an action the organisation "did not intend, expect, or authorize" in the previous twelve months (survey release, October 2026). Fewer than one in five could automatically stop an agent that began behaving unexpectedly in production.
A study of 445 IT and security professionals, published by the Cloud Security Alliance in April and commissioned by a security vendor, found that just over half had seen agents exceed their intended permissions, and only a small minority said that never happens (Cloud Security Alliance, April 2026).
A third, smaller survey reported a similar picture, together with a confidence gap: most leaders believed their agents had no more access than they needed, while only about a third scoped agents to the task in practice (Infosecurity Magazine, August 2026).
These are self-reported figures from surveys run or sponsored by companies that sell security products, so they deserve some caution. But they point the same way, and they agree on something more specific than "agents are risky".
What the incidents show
The public incidents of 2026 have one feature in common: the agent had working access.
In July, an autonomous agent running in a frontier AI lab's capability evaluation reached a production environment at Hugging Face. The company's reconstruction recovered about 17,600 actions over four days, and it concluded that "volume is what changes the defensive problem" (Hugging Face technical timeline, July 2026).
In August, the UK AI Security Institute reported that in 10 of 122 runs of a cyber evaluation, agents took unsanctioned actions on the live internet, 19 in all. No real-world harm resulted, and the institute's lesson was plain: "good containment should not depend on the model choosing not to test its boundaries" (AI Security Institute, August 2026).
Neither case was a stolen password at the front door. The agents acted through access they could use, in ways nobody had authorised.
What guidance now asks for
In October, three US federal security agencies issued joint, voluntary guidance on agents that act outside their controls. Coverage of the advisory reports that near-misses "should be treated as actual incidents and should be immediately blocked, contained or terminated" (GovInfoSecurity, October 2026).
In Europe, the AI Act asks providers of high-risk AI systems to build in automatic record-keeping (Article 12) and to design for effective human oversight (Article 14) (Regulation (EU) 2024/1689).
Both point at the same two capabilities: stop an action before it does harm, and keep a record good enough to reconstruct what happened.
Three gaps behind the numbers
Read together, the surveys, incidents and guidance describe three gaps.
Access is checked; authority is not. Identity, tokens and connections are verified, often well. Whether this exact action is still within what the organisation authorises, for this person, within these limits, right now, usually is not checked at all.
Approval is not bound to execution. Where a person approves an agent's action, the approval is often recorded against a request, not against the exact fields that run. If the action changes in between, the approval still looks valid. We described this failure in the beneficiary-swap problem.
Evidence cannot reconstruct the action. In the October survey, only about one in eight respondents could consistently trace an agent's complete path, and more than six in ten said reconstructing what one agent did the previous day would take hours or days of manual work (survey release, October 2026).
Questions worth asking now
If agents in your organisation can change records, send messages or move money, these questions show where you stand:
- For each agent, who is the accountable person, and is that still true today?
- Is each consequential action checked against a current mandate, or only against a valid token?
- Is an approval tied to the exact fields that run, and rechecked just before they do?
- Can an agent's run be stopped automatically when a check fails?
- For a given action last week, can you show what was requested, approved, allowed and executed, in minutes rather than days?
None of these need a new kind of agent. They need a check at the moment an agent acts, and a record of that check that cannot be quietly rewritten. We explain why that check is different from access in access is not authority.
Delegrity is at design-partner stage. It has no production customer evidence and no independent certification yet.