al-ice.ai

Nobody Can Stop It, Nobody Owns It: The Agent Accountability Gap Got Worse in Six Months

Agent & Supply Chain Security by al-ice.ai Editorial

Gravitee's third State of AI Agent Security wave — an October 2026 survey of 900 senior technology leaders at UK and US organizations with 250+ employees, published in the November 2026 report (announced 9 November) — is the rare vendor survey worth reading as a longitudinal instrument: the same questions asked in April 2026 (n=750) were asked again in October, and nearly every readiness measure fell while estates kept growing. The headline pair: 16% of organizations now run more than 150 AI agents, up from 7% in April, yet only 6% can revoke a misbehaving agent's access to all systems within an hour and fewer than 1 in 10 (9.5%) have a named individual formally accountable for agent behavior. Deployment doubled; the ability to answer for it did not move.

Confidence cracked, capability barely moved

The April-to-October deltas read like optimism meeting production. The share feeling very prepared to respond to a serious agent incident fell from 47.1% to 29.3%; belief that current regulation covers agent risks fell from 39.5% to 25.6%; feeling very prepared to govern agents as a distinct user type fell from 30.4% to 19.2%; fully securing and governing every agent before go-live fell from 19.7% to 11.6%. Over the same six months, the mean share of each fleet actually monitored and secured rose just 55.6% to 57.1% — 1.4 points. Incidents, not investment, appear to have done the educating: 51.7% experienced or suspected an agent security or privacy incident in the past 12 months (21.4% confirmed more than one), led by financial services (66%) and healthcare (63%).

The post-incident ledger shows how thin accountability is when tested. After an incident: policies or controls changed 33.3%, the team was held collectively responsible 27.9%, the AI vendor or model provider was held responsible 27.7% — about as often as anyone inside — a named individual was held formally responsible only 24.7%, the agent was decommissioned 24.5%, and 17.3% recorded it and changed nothing. Only 1 in 4 incidents ended with a named person answering for it. Incident patterns also shifted toward the agentic failure modes: agents acting outside their scope rose from 16% to 25% of incidents, data sent outside the organization from 15% to 21%, and regulated health-data exposure from 2% to 13% — with verbatims like “agent leaked internal pricing data externally” and “agent shared restricted clinical data.”

The identity and revocation numbers defenders should memorize

Accountability, per the report's own definition, needs six things — agent identity, a named owner, defined purpose and limits, enforced access, traceability, and a working stop button — and each is missing for most organizations. Only 17% give every agent its own identity; 18.1% share one service account across agents, 14.2% run agents on the deploying human's credentials (whose actions then log as that person), 13.1% use static API keys in code or config — 45% rely mainly on shared accounts, borrowed human credentials, or static keys. No pre-launch control is used by more than about a third of organizations, and the accountability-tied ones lost the most ground: a named accountable person fell 6.9 points to 30.9%, a documented pause/revoke process fell 3.9 points to 30.2%.

On the stop button specifically: 97% say they are prepared for an agent incident, but 6.3% can revoke access within an hour while 46.3% need more than a day — and revocation is not theoretical, with 57.6% having pulled an agent's access during a real incident in the past year. Only 12.5% can fully reconstruct what an agent did 30 days ago, what data it touched, and whose authority it used. New this wave, the chain question: 97% run agents that invoke, delegate to, or exchange data with other agents, 40% connect to agents belonging to other organizations (54.7% in financial services) — but only 26.5% define accountability across the full chain, with the rest splitting almost evenly between blaming the initiating agent and the final one. With two in five routing work through agents they do not own, that disagreement is a contract and liability problem, not just a technical one.

What this means next to everything else we track

This is the six-months-on sequel to our May governance-gap briefing, which carried the April wave's 88%-have-had-an-incident finding alongside Kiteworks — linked, not restated. The direction of travel since then is uniformly negative on controls and uniformly positive on scale: 75% plan to deploy more agents, almost none plan to cut back, 23% of agents act with full autonomy on average (27% in government), and significant pressure to ship before governance is ready eased only from 25.8% to 16.3% — while 77% still feel it. Read it alongside the year's incident ledger: agents that cannot be stopped or attributed are the substrate for the BluePhishing hidden-identity technique, the unreviewed MCP dependency drift, and the “Don't Ask Again” secret sprawl — each is cheaper to exploit where identity is shared, logging is borrowed, and revocation takes days.

What to actually do

  1. Give every agent its own identity before adding more agents. Seventeen percent is the number to beat; shared service accounts and human-credential borrowing make every downstream control — logging, scoping, revocation — someone else's problem.
  2. Make revocation a measured SLA, not a capability checkbox. If your answer is not “within the hour,” you are with the 94% — test it in an exercise (only 33.2% have) before a real incident (57.6% already have) tests it for you.
  3. Close the pre-launch gap on the two controls that fell most. Name an accountable individual and document the pause/revoke path for every agent going live; “most of them are covered” dropped while estates doubled.
  4. Write chain accountability into contracts now. Where your agents invoke outside organizations' agents, decide in writing whether the initiator or the final actor answers — 16% admit it is simply unclear, and the rest are split down the middle.
  5. Instrument the 30-day audit question. “What did this agent do, what data did it touch, whose authority did it use?” — if that takes a forensic project, traceability is the control to fund first.

Our verification was read-only. We read the full Gravitee State of AI Agent Security report page first-hand on 12 November 2026 (October 2026 survey, n=900 UK/US leaders, trends vs April 2026 n=750; all figures above taken from the report's own charts, including the 16%-vs-7% estate growth, 47.1%-to-29.3% preparedness fall, 55.6%-to-57.1% monitored-and-secured share, 51.7% incident rate, 17% per-agent identity with the 18.1/14.2/13.1 identity mix, 6.3% within-hour revocation with 57.6% real-incident use, 12.5% full traceability, 24.7% named-individual post-incident accountability, 9.5% named ownership, the 22.3/20.7/20.4/19.9/16.6 responsibility split, and the 97%/40%/26.5% agent-chain figures). The 9 November announcement and Cybernews coverage are carried as reported. As a vendor survey these are self-reported attitudes and shares, not audited controls — stated openly. We contacted no vendor and ran no survey. Brave Search was used for discovery only.

Sources: