A hands-on drill about one blind spot in AI agent security: agents that stop running but never stop being authorized. 100 agents below. 76 haven't run in two months. Their credentials still work. Send one unsigned call from outside and see what answers. Then turn on an expiry policy and send it again.
Takes about 20 seconds. Nothing is uploaded; it all runs in your browser.
How to read it. Grey squares are agents nobody has thought about in 60 days. The amber-edged ones can be started by anyone who finds their webhook. Red is what a single unsigned call from outside wakes up; a white dot means that agent then reached a sensitive system. The expiry toggle revokes any credential idle past 60 days. The signed-triggers toggle refuses unsigned wake-up calls. Either control works; together they close the surface.
Method. Synthetic fleet proportioned to published vendor telemetry from thousands of production agents over 12 weeks: 76% idle ≥60 days (44% ≥180), 24% of dormant agents startable by an unsigned external webhook, 70% able to reach sensitive systems such as cloud storage. Illustrative, not a measurement of any real organization.
(Views my own.)
We authorize AI agents the way we authorize people: a scope, a set of permissions, a login. But people come with a lifecycle. Joiners, movers, leavers. A person who stops showing up gets noticed. An agent that stops running looks exactly like an agent that's fine.
Published telemetry from thousands of production agents makes the gap concrete. Three-quarters hadn't run in 60 days, yet their credentials still worked and their triggers still fired. A quarter of those dormant agents could be started by an unsigned call from outside the organization. Most could reach sensitive systems. None of that shows up as an alert, because nothing is wrong. Yet.
Two things are colliding. Frontier models are making vulnerability discovery faster than defenders can close the gap, a point the UK's financial regulator made in a recent review. And agent populations are growing faster than anyone retires them. A dormant agent with live credentials and a reachable trigger is latent capacity to act, sitting inside the perimeter, waiting for whoever gets there first.
Dormancy isn't absence of risk. It's unexercised authority.
The drill's fleet is synthetic and proportioned to the Arrakis figures. It illustrates a mechanism; it does not measure any real organization. Vendors are named here as sources only.