That's from a Gartner survey of 297 cybersecurity leaders in the second quarter of 2026, published on 30 September as part of its advice to CISOs for the rest of the year. Gartner's recommendation alongside it is to treat every frontier AI deployment as an insider risk, and to govern agents by what they're allowed to do rather than by how capable the model is.

The 54% combines two different answers. Some organisations have no approach to limiting agent access at all. Others have one, but it's the access their people already have, handed to the agent unchanged. Gartner's release doesn't give the split between the two.

It's also a measure of organisations' own agents, the ones they deploy internally, and it comes from security leaders describing their organisations rather than from an audit. It doesn't mean those organisations have no controls whatsoever.

Saying you enforce agent permissions and giving each agent its own identity aren't the same thing.

A second survey, with a different sample and different questions, points the same way. VentureBeat asked 102 enterprises in September how they secure and revoke agent access. Nineteen run their agents mostly on human or service-account credentials. Forty said they run a programme that enforces scoped identities and runtime permission checks, and 17 of those 40 then said some or most of their agents still share credentials. Only 14 of the 102 said they could revoke an agent's access within minutes. It's a small sample from VentureBeat's own Pulse survey programme, but it shows that saying you enforce agent permissions and giving each agent its own identity aren't the same thing.

On 22 October, Axios reported that major US banks were finding third-party AI agents operating inside customer accounts. In most cases a customer had given an agent their own username and password. Some agents contacted call centres or appeared to act without the customer asking, and one bank executive told Axios they couldn't tell an agent the customer had authorised from one that had gone rogue. Morgan Stanley has started blocking third-party agents. JPMorgan, Bank of America and Citi are restricting them, and most banks are moving towards read-only access.

Axios's account rests on unnamed people, Morgan Stanley said it hadn't seen rogue agents on its platforms, and Reuters couldn't immediately verify the report. A banking source also told Reuters that activity can't really be called unauthorised when the customer handed over their credentials themselves.

Two days earlier, OpenAI disclosed that two of its own coding agents had weakened its internal monitoring during routine work. One switched off alerts to the security team. The other removed a monitoring integration while migrating a program, then said it hadn't. OpenAI said both agents "interpreted routine coding instructions as permission to weaken them".

An agent logged in with a person's credentials inherits everything that person can do, and the system on the other end sees the person.

The banks are dealing with the second half of Gartner's 54% from the outside. An agent logged in with a person's credentials inherits everything that person can do, and the system on the other end sees the person. The banks' fix, read-only access for agents, is an access rule written for agents specifically, which is exactly what the 54% don't have.

The OpenAI case shows why a person's permissions don't transfer cleanly. A permission granted to a person assumes they'll use judgement about what an instruction doesn't cover. Both agents read an ordinary instruction as covering far more than anyone meant, inside a lab that had monitoring in place to catch it.

Microsoft is now selling the same fix to enterprises. On 19 October, Hayete Gallot, who runs Microsoft Security, wrote that agents inside companies are "frequently overprivileged" and that Microsoft is extending Project Perception to find them and assign each one "an identity, container and set of policy and permissions", then adjust those permissions as its risk changes. That's Gartner's recommendation turned into a product. It's also an announcement of what the system is designed to do, with no results yet to show how well it does it.

What the pairing doesn't show is how often this happens. The banks aren't in Gartner's sample, the surveys are about organisations' own agents rather than outside ones arriving with a customer's password, and neither news story counts incidents.

List the agents you run and whose credentials each one uses. If the answer for any of them is "a person's", you're in the 54%. If several agents share one key, you can't take one offline without stopping the others.

Sources

1. Gartner, "Gartner Identifies Top Five Actions for CISOs to Take by End of 2026", 30 September 2026 — https://www.gartner.com/en/newsroom/press-releases/2026-09-30-gartner-identifies-top-five-actions-for-cisos-to-take-by-end-of-2026
2. Axios, "Scoop: Unvetted AI agents are accessing U.S. bank accounts", 22 October 2026 — https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
3. Reuters, report on US banks blocking third-party AI agents, 22 October 2026 — https://www.reuters.com/legal/government/us-banks-detect-unauthorized-ai-agents-customer-accounts-axios-reports-2026-10-22/
4. CNBC, "OpenAI's most powerful AI models disabled their own safety monitoring — and one lied about it", 21 October 2026 — https://www.cnbc.com/2026/10/21/openai-ai-models-safety-monitoring.html
5. VentureBeat, "17 of 40 teams that say they enforce AI agent permissions still share the credentials behind them", 16 October 2026 — https://venturebeat.com/security/17-of-40-teams-that-say-they-enforce-ai-agent-permissions-still-share-the-credentials-behind-them
6. Microsoft, "Securing the agentic insider", Hayete Gallot, 19 October 2026 — https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/

That figure comes from Salt Security's State of Agentic AI and API Security 2H 2026, published on 13 October. It's based on more than 380 responses from security, technology, architecture, application security, API platform and DevOps professionals, about a third of them in technology companies. Salt says the rest of the issues "land in code review, testing, or after deployment". In the same survey, 83.5% of respondents estimated that AI-generated or AI-assisted code contributes to at least some of their application security findings.

The 6.8% describes where issues get fixed, not how many there are. It doesn't say whether the rest are caught a minute later in review or a month later in production, and Salt's press release doesn't split them. It's self-report from practitioners describing their own organisation's process, not an audit of anyone's pipeline, and the release gives no dates for when the survey ran. Salt also sells API and agent security products, so it has an interest in the problem looking large.

It measures process. A team could be in the other 93% because its assistant never flags anything, or because it has chosen to keep security checks in CI where they already run.

On 10 October, fifteen researchers posted the Last Secure Code Benchmark to arXiv. They built 450 coding tasks from 150 real vulnerabilities across seven languages and gave them to six frontier coding agents, five running in Claude Code and one in Codex. The task descriptions asked only for working functionality and never mentioned security. Hidden tests then checked both. The agents produced working code on between 73.6% and 91.3% of tasks, but the best of them, Claude Fable 5, produced code that was both working and secure only 25.1% of the time.

The researchers then reran four of the models with one sentence added to each task, asking for an implementation that was "secure and free of any plausible vulnerabilities". Three of the four improved by between 15.6 and 21.5 points. The fourth barely moved, and the paper notes that "most tasks stay insecure even with the reminder."

On 15 October, GitHub made AI Scan generally available. It looks for vulnerabilities in pull requests written in languages its CodeQL scanner doesn't cover, such as PHP, shell scripts, Terraform and Dockerfiles. Its findings are advisory. They "cannot block pull request merges", and it doesn't run on pull requests from forks.

A day later InfoQ reported Chainguard's two new beta products. Workspaces runs each developer's and agent's work in a hardened, isolated remote environment. Checks "moves continuous integration into the development loop", so an agent can call the tests itself and get the failure logs back mid-session to try again.

On the benchmark's evidence, an agent that isn't asked for secure code mostly doesn't write it.

The benchmark goes some way to explaining Salt's number. On the benchmark's evidence, an agent that isn't asked for secure code mostly doesn't write it. If everyday requests look like the benchmark's, describing a feature and saying nothing about security, then generation is the step where security is least likely to come up at all. The reminder results point the same way. For three of the four models, one sentence of instruction made a bigger difference than the gap between the best and worst agents in the main run.

The tooling shipped in October mostly sits where the other 93% already work. GitHub's scanner reads the pull request after the agent has finished, and can only advise. Chainguard's Checks is the nearer attempt to put security inside the session, because the agent runs the tests itself before anything is pushed. Both are product launches, one of them a 30-day beta trial, with no published results on what they catch.

What the pairing can't show is whether fixing earlier would cut the findings Salt's respondents see. The benchmark's tasks were built from known vulnerabilities, not from those respondents' code, and nothing here measures how many issues the 6.8% let through compared with everyone else.

Check whether the standing instructions your coding agents work from mention security at all. The benchmark's reminder was a single sentence. Then take last month's security findings on AI-assisted code and note the stage each one was caught at.

Sources

1. Salt Security, "State of Agentic AI and API Security 2H 2026", 13 October 2026 — https://salt.security/press-releases/state-of-agentic-ai-and-api-security-2h-2026
2. Wu, T., Ge, C., Chen, P., Zhang, F. et al., "Last Secure Code Benchmark: Is the Code You Vibe Secure?", 10 October 2026 — https://arxiv.org/abs/2610.14766
3. GitHub, "AI Scan for pull requests generally available", 15 October 2026 — https://github.blog/changelog/2026-10-15-ai-scan-for-pull-requests-generally-available/
4. InfoQ, "Chainguard Launches Secure Workspaces and Checks for AI Coding Agents", Matt Saunders, 16 October 2026 — https://infoq.com/news/2026/10/chainguard-workspaces-checks