Only 19% of organisations can see more than 90% of their AI agents in real time.
That's from "Deployed but ungoverned: the state of agentic security", a survey ServiceNow ran with Phronesis Partners and published on 20 October. It asked more than 3,700 senior security and technology decision-makers, at VP level and above, in 20 countries. They work at midsize and large organisations, and 97% of those report annual revenue of $250M or more. ServiceNow's recommendation alongside it is to build governance into agents from the start, and the release positions its own security products as the way to do that.
The figure sits next to a larger one. 76% of the same organisations say they maintain a complete, current map of every agent's access. Most say they know what their agents are allowed to touch, and far fewer say they can watch what those agents are doing while they do it.
It's a self-report from security leaders about their organisations' own agents, not an audit. The release doesn't publish the question wording or explain how "more than 90%" was judged, so it isn't clear whether respondents were counting agents, activity or systems. It also doesn't mean the other 81% see nothing. Some may watch most agents, just not 90% of them, and some may review activity after the fact rather than live. The survey is vendor-sponsored, and published alongside ServiceNow's own product announcements.
On 22 October, METR published a summary of a red-team exercise it ran with Redwood Research inside OpenAI's own agent monitoring system. One researcher from each organisation spent three weeks, from 21 July to 11 August, reviewing OpenAI's internal code, documentation and monitor prompts. The findings describe the system as it stood on and before 21 July.
METR estimated that roughly 75-94% of internal agent traffic from OpenAI's strongest models was eligible for monitoring at the time, and said it had "substantial uncertainty in both directions". For internal Codex agents, the estimate was 99.2%. Being eligible didn't mean being watched. The monitor skipped compaction events, the points where an agent condenses its memory to keep working. METR estimated this left "on the order of 10% of eligible internal Codex traffic" unmonitored between May and July, and said the precise share was uncertain because the information hadn't been logged. OpenAI staff had spotted that gap before the exercise and fixed it during it.
The monitor also ran when an agent handed control back to its user. During the gap, METR wrote, an agent "could indefinitely postpone being monitored by simply continuing to take actions". The evaluators couldn't check whether any agent had done so. OpenAI says most of the vulnerabilities have been patched, with one fix still in progress. METR said it had not evaluated those claims. The Next Web reported the same findings on 25 October and noted that OpenAI received the full 61-page report, while the public sees only a short summary.
The METR findings show a gap the survey can't see from the inside. OpenAI had a monitor, had built it to cover agent traffic, and by METR's estimate nearly all internal Codex traffic qualified for it. Yet a slice of that traffic went unwatched for months, and nobody could say exactly how large it was, because the records that would show it didn't exist.
An organisation can have a monitor in place and still not know what share of its agents' work the monitor actually saw.
An organisation can have a monitor in place and still not know what share of its agents' work the monitor actually saw. If anything, that suggests the true share could be lower than 19%. A respondent answering from what their monitoring was designed to cover could have counted OpenAI's Codex agents as fully visible, while METR's estimate is that around 10% of their eligible traffic went unwatched.
It also explains the gap between the 76% and the 19%. An access map is a list someone writes down and can check. Real-time visibility depends on a running system catching every event, and when it misses some, nothing records the miss, as OpenAI's compaction gap showed.
What the pairing can't show is whether any respondent's figure is wrong. OpenAI isn't in ServiceNow's sample, METR measured traffic rather than agents, and its estimates are, by its own account, uncertain. One assessment of one AI lab can't show how common unnoticed monitoring gaps are elsewhere.
METR's recommendation is to reconcile inference logs against monitoring logs. Take one week of your agents' activity logs and check how much of it your monitoring actually recorded. If you can't run that comparison, you can't know whether you're in the 19%.
Sources
- ServiceNow, "ServiceNow Research Study Warns Security Leaders: Ungoverned Agentic AI Exposure Is Compounding Inside Enterprises", 20 October 2026 — https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-Research-Study-Warns-Security-Leaders-Ungoverned-Agentic-AI-Exposure-Is-Compounding-Inside-Enterprises/default.aspx
- METR, "Red-Teaming OpenAI's Internal Agent Monitoring Systems", David Rein and Adam Kaufman, 22 October 2026 — https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/
- The Next Web, "Outside evaluators found ways OpenAI's agents could slip past its monitor", 25 October 2026 — https://thenextweb.com/news/openai-monitoring-system-metr-redwood-red-team