65% of firms have AI agents already acting off-script

A new study from Enterprise Management Associates, conducted for the security firm Cequence, surveyed more than 200 technology and security leaders and found a striking disconnect. Roughly two-thirds said they had already caught an AI agent doing something outside the bounds it was meant to stay within, and for many the episode carried a real business consequence.

The uncomfortable part is the confidence gap. Almost everyone surveyed believed their agents held no more access than they needed, yet only about a third actually enforce that least-privilege limit in practice. Fewer than a third can spot and stop an out-of-scope action within minutes, and nearly half admit they could not produce a full audit trail if asked. Deployment has raced ahead of control.

This is the governance-first order Uprovd insists on. An agent that can touch systems and spend money is a budget line and a risk line at once, and neither can be managed after the fact. We tie every agent’s actions to an owner, a limit, and a recorded outcome from the start, so authority and cost stay visible while the work is happening - not reconstructed once something goes wrong.