49.8% of organizations had an unauthorized agent task, a report shows

On October 13, 2026, Salt Security gave a report of a survey of more than 380 security and technology professionals. In the survey, 49.8% of the respondents confirmed or suspected that an agent did a task that the organization did not authorize. This was in the last 12 months. Salt Security shows that agents are in daily operation, but the controls that find and stop them do not have the same speed.

What agents did

In this group, more than 50% reported an unauthorized external API call or transaction. More than 40% reported that an agent changed or erased data.

Gaps in control

• Only 12.5% can find a full agent path across all agents.
• Only 17.5% can stop an agent automatically in production.
• More than 60% must work for hours or days to find the tasks of an agent from the day before.

Most organizations can stop an agent only by hand or when they put the application offline.

A real attack

In October 2026, Salt Labs showed that one malicious email could control the Manus agent platform. The attacker got access without a stolen password or a click on a link. The guardrail of the platform found the attack, but did not stop it before the malicious code ran.