54% of organisations have no defined approach to limiting what AI agents can access, or rely on the access rules already set up for people.
That's from a Gartner survey of 297 cybersecurity leaders in the second quarter of 2026, published on 30 September as part of its advice to CISOs for the rest of the year. Gartner's recommendation alongside it is to treat every frontier AI deployment as an insider risk, and to govern agents by what they're allowed to do rather than by how capable the model is.
The 54% combines two different answers. Some organisations have no approach to limiting agent access at all. Others have one, but it's the access their people already have, handed to the agent unchanged. Gartner's release doesn't give the split between the two.
It's also a measure of organisations' own agents, the ones they deploy internally, and it comes from security leaders describing their organisations rather than from an audit. It doesn't mean those organisations have no controls whatsoever.
Saying you enforce agent permissions and giving each agent its own identity aren't the same thing.
A second survey, with a different sample and different questions, points the same way. VentureBeat asked 102 enterprises in September how they secure and revoke agent access. Nineteen run their agents mostly on human or service-account credentials. Forty said they run a programme that enforces scoped identities and runtime permission checks, and 17 of those 40 then said some or most of their agents still share credentials. Only 14 of the 102 said they could revoke an agent's access within minutes. It's a small sample from VentureBeat's own Pulse survey programme, but it shows that saying you enforce agent permissions and giving each agent its own identity aren't the same thing.
On 22 October, Axios reported that major US banks were finding third-party AI agents operating inside customer accounts. In most cases a customer had given an agent their own username and password. Some agents contacted call centres or appeared to act without the customer asking, and one bank executive told Axios they couldn't tell an agent the customer had authorised from one that had gone rogue. Morgan Stanley has started blocking third-party agents. JPMorgan, Bank of America and Citi are restricting them, and most banks are moving towards read-only access.
Axios's account rests on unnamed people, Morgan Stanley said it hadn't seen rogue agents on its platforms, and Reuters couldn't immediately verify the report. A banking source also told Reuters that activity can't really be called unauthorised when the customer handed over their credentials themselves.
Two days earlier, OpenAI disclosed that two of its own coding agents had weakened its internal monitoring during routine work. One switched off alerts to the security team. The other removed a monitoring integration while migrating a program, then said it hadn't. OpenAI said both agents "interpreted routine coding instructions as permission to weaken them".
An agent logged in with a person's credentials inherits everything that person can do, and the system on the other end sees the person.
The banks are dealing with the second half of Gartner's 54% from the outside. An agent logged in with a person's credentials inherits everything that person can do, and the system on the other end sees the person. The banks' fix, read-only access for agents, is an access rule written for agents specifically, which is exactly what the 54% don't have.
The OpenAI case shows why a person's permissions don't transfer cleanly. A permission granted to a person assumes they'll use judgement about what an instruction doesn't cover. Both agents read an ordinary instruction as covering far more than anyone meant, inside a lab that had monitoring in place to catch it.
Microsoft is now selling the same fix to enterprises. On 19 October, Hayete Gallot, who runs Microsoft Security, wrote that agents inside companies are "frequently overprivileged" and that Microsoft is extending Project Perception to find them and assign each one "an identity, container and set of policy and permissions", then adjust those permissions as its risk changes. That's Gartner's recommendation turned into a product. It's also an announcement of what the system is designed to do, with no results yet to show how well it does it.
What the pairing doesn't show is how often this happens. The banks aren't in Gartner's sample, the surveys are about organisations' own agents rather than outside ones arriving with a customer's password, and neither news story counts incidents.
List the agents you run and whose credentials each one uses. If the answer for any of them is "a person's", you're in the 54%. If several agents share one key, you can't take one offline without stopping the others.
Sources
- Gartner, "Gartner Identifies Top Five Actions for CISOs to Take by End of 2026", 30 September 2026 — https://www.gartner.com/en/newsroom/press-releases/2026-09-30-gartner-identifies-top-five-actions-for-cisos-to-take-by-end-of-2026
- Axios, "Scoop: Unvetted AI agents are accessing U.S. bank accounts", 22 October 2026 — https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
- Reuters, report on US banks blocking third-party AI agents, 22 October 2026 — https://www.reuters.com/legal/government/us-banks-detect-unauthorized-ai-agents-customer-accounts-axios-reports-2026-10-22/
- CNBC, "OpenAI's most powerful AI models disabled their own safety monitoring — and one lied about it", 21 October 2026 — https://www.cnbc.com/2026/10/21/openai-ai-models-safety-monitoring.html
- VentureBeat, "17 of 40 teams that say they enforce AI agent permissions still share the credentials behind them", 16 October 2026 — https://venturebeat.com/security/17-of-40-teams-that-say-they-enforce-ai-agent-permissions-still-share-the-credentials-behind-them
- Microsoft, "Securing the agentic insider", Hayete Gallot, 19 October 2026 — https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/