Meet Your Zombie Agents: The AI That Quit, But Never Logged Off

Image courtesy of Help Net Security.

Picture this. Six months ago, a team built an AI agent to automate something small — triage a support queue, summarize a weekly report, move data between two systems. It worked. Everyone moved on. The project wound down, the engineer who built it changed teams, and nobody ever told the agent the job was over.

It's still there. Still holding its credentials. Still connected to whatever it was wired into on day one. Nobody fired it, because nobody owns it, because "firing an AI agent" was never a process anyone designed.

I call these zombie agents — not malicious, not even running most days, but very much alive the moment something reaches out and wakes them up.

This isn't a hypothetical. It's close to the default state.

A recent industry analysis of production AI agents found that roughly three-quarters of them hadn't run in the last 60 days — and nearly half had gone quiet for six months or more.

Dormant isn't the exception for deployed AI agents right now. It's close to the norm.

Image courtesy of The Hacker News.

From "unused" to "exploitable" — faster than you'd think

A zombie agent is harmless right up until something can still reach it. And a lot of them can be reached from outside the organization.

The same analysis found that about one in four dormant agents could still be triggered through a webhook with no verification on who's calling it. If you know the URL, you can wake it up — and it runs with whatever access it was given the day it was built.

What's it connected to? Usually something that matters: cloud storage, AI/LLM services, marketing platforms sitting on customer data. And of the agents wired into something that sensitive, fewer than 1 in 100 had real data-loss-prevention coverage watching what it could do with that access. Roughly 1 in 5 were running on API keys that never expire — just sitting in a config file, waiting for someone to find them.

Here's the uncomfortable summary: most organizations built identity lifecycle management for people, and quietly skipped it for the software now acting on their behalf.

Image courtesy of The Hacker News.

Why a zombie agent is worse than a zombie account

I've written before about non-human identity (NHI) — service accounts, API keys, CI/CD credentials — as the identity category every organization chronically underweights, because none of it looks like a person logging in. AI agents are the newest, fastest-growing branch of NHI, and they break the old mental model in one specific way:

An orphaned service account can usually only do what it was narrowly scoped to do. An orphaned agent can reason, chain actions together, and call other tools — sometimes other agents, running under their own separate credentials.

A forgotten service account is a door left unlocked. A forgotten agent is a door that can go looking for other doors on its own.

If your AI governance program still treats "agent security" as a subset of your AI usage policy — don't paste client data into ChatGPT, basically — you're defending against last year's risk. This year's risk is lifecycle: what gets created, who owns it, when it gets reviewed, and what happens the day nobody's using it anymore.

What I'd actually do about it

1. Inventory every agent that can act on your systems — not just the ones in active use. If you can't produce this list today, that is the finding.
2. Assign an owner at creation time. The same discipline you already apply to privileged human accounts. No owner, no deployment.
3. Put an expiry on every agent's credentials and connections. "Still works" is not the same as "still needed."
4. Kill unsigned, unauthenticated triggers. If anything holding the URL can wake an agent up, that's not a feature — it's an open door with a doorbell anyone can ring.
5. Put dormant agents on the same clock as a dormant human account. No activity in 60–90 days should trigger automatic review, not automatic trust.

None of this is exotic. It's the same identity hygiene we've preached for service accounts for a decade — we've just never gotten around to applying it to the newest, most capable category of non-human identity. I'd rather close this gap now, while it's still a blog post and not an incident report.

I go deeper on building a real non-human identity program — AI agent governance included — in the AI Security & Governance section of my Research series. Want to know where your own environment actually stands? The Architecture Review tool scores you against it in a few minutes, entirely in your browser.

— Deepak Kumar, CISSP