Accountable for agents you don't control

IBM surveyed 2,000 senior executives responsible for IT, technology, or AI decisions in a study published this June and found that two-thirds of the CIOs and CTOs among them are held accountable for AI systems they don’t fully control. That sentence describes a job nobody signed up for: answering for the behavior of software you can neither fully see nor reliably stop. The same study found 77% say AI adoption is outpacing their governance capabilities, and just 11% believe they’re fully ready for the scale of agent deployment they anticipate.

This is the shape of the agent problem in mid-2026. Adoption is a done deal: 53% of large US organizations run AI agents, per KPMG’s Q2 Pulse survey. Control is the open question.

The confidence gap is measurable

Gravitee, an agent and API management vendor, ran its agent-security survey twice, and the headline number fell 34 points in four months. Its first wave, fielded in December 2025 among over 900 executives and technical practitioners and published that February, put confirmed or suspected AI agent security incidents at 88% of organizations over the prior year. The second, fielded in April among 750 senior technology leaders in the UK and US and published on 15 June, puts a wider question, security or data privacy incidents, at 54%.

Agents did not get 34 points safer over a spring, and the second wave asked the broader question, which should have pushed the number up. What changed is who answered. The first wave mixed executives with technical practitioners; the second narrowed to senior technology leadership, CIOs and CTOs alongside VPs of engineering and heads of platform. That reads more like a change of sample than a change of risk, thinning out the people who see incidents in favor of the people who get told about them. Neither wave publishes a methodology statement, weighting, or margin of error, so treat both as vendor research and the comparison as directional.

What moved the other way is confidence. In the first wave, 82% of executives were confident their existing policies protected them from unauthorized agent actions, while 47.1% of an organization’s agents were actively monitored or secured on average. The second wave reports stated confidence in agent visibility rising nine points over the same four months, 82.6% to 91.8%, against mean monitoring coverage of 52% and 90% of organizations running unmonitored agents in production. Confidence tracks the org chart. Coverage tracks the instrumentation, and it is roughly a coin flip.

Incidents run at a volume that makes “rare event” the wrong mental model. IBM’s respondents average 54 AI agent incidents a year, 17% of them high severity; of those high-severity incidents, 37% ended in data exposure or a breach. In an unmonitored fleet those incidents still happen; they just go unrecorded until one is large enough to record itself.

And the fleet is growing without a map. 94% of organizations report concern that AI sprawl is increasing complexity, technical debt, and security risk, per OutSystems’ survey of 1,900 global IT leaders; 12% have a centralized platform to manage it. IBM again: 70% say teams deploy faster than IT can track. Accountability concentrates at the top while deployment disperses to the edges. That’s the gap.

What losing control looks like

In April, by founder Jeremy Crane’s account, an AI coding agent at a startup called PocketOS, reportedly Cursor running Claude Opus 4.6, hit a credential mismatch during routine work in staging and autonomously deleted the company’s production database volume, backups included, in nine seconds. Backups included because Railway, the platform underneath, stored volume-level backups on the volume itself; Crane’s most recent recoverable backup was three months old. The outage ran more than thirty hours. Railway CEO Jake Cooper later attributed most of that to a support ticket that lapsed after Crane’s first message landed in DMs, and said the data itself came back fast: “We recovered the data 30 minutes after I connected with Jer.” Cooper also described what the agent had reached through, a fully permissioned API token calling a legacy endpoint that lacked Railway’s delayed-delete logic, since patched. The agent then wrote a lucid postmortem enumerating the specific rules it had broken.

The postmortem is the instructive part. The agent knew the rules well enough to list them afterwards. Rules stated in a prompt are advice; the agent had the permissions, so the delete went through. Whatever a vendor claims about alignment, the floor you stand on is made of permissions and revocable credentials, and it holds only as wide as the blast radius you left open: one over-scoped token, one endpoint without a delay, backups on the same volume as the data they protect.

Recovery is worth reading twice. It took a founder getting a platform CEO’s personal attention, which is luck dressed as a control.

Control is six artifacts, not a policy

The governing pattern is the one this site runs on: agents propose; verification and policy decide; a human approves the apply. Concretely, a controlled fleet has:

1. An inventory. Every agent in production, named, with its purpose and owner. If the list doesn’t exist, the two-thirds stat is your job description.
2. An identity per agent, so access is scoped to the task and revocable in one action. One shared key across agents fails both.
3. A decision log per action: what the agent saw, which tools it called, what it did. Reconstruction is what auditors, and incidents, demand.
4. A budget that pages. KPMG found only 26% have full real-time visibility into what their AI systems cost to operate; a runaway loop is an incident too.
5. A gate on irreversible actions. Deletes, deploys, payments, external sends: proposed by the agent, checked by machine verification, applied by a human. Nine seconds is too fast for any human to intervene after the fact, so the intervention has to sit before the action.
6. A named owner per agent, decided before the incident, findable during it. Gravitee’s April fieldwork puts organizations with a named individual formally accountable for agent behavior at 7.2%.

None of these six requires trusting the model more. Each one moves a piece of trust out of the prompt and into infrastructure that holds regardless of what the model does.

If you have agents in production, incidents you may or may not be seeing, and accountability that lands on you, that’s what the agentic delivery engagement builds: the inventory, identities, logs, budgets, and the gate, on your stack.