Half of Companies Had an AI Agent Go Off-Script. Could You Prove What Yours Did Yesterday?

It's Monday morning. Someone in finance notices a supplier record was changed over the weekend. Bank details updated, approval logged, everything looks tidy. The question is simple: did a person do this, or did one of the AI agents connected to the finance system?

Nobody can answer it quickly. The logs show the change. They don't show who, or what, decided to make it, or why.

That scene is no longer hypothetical. New research released this week puts a number on how common it has become, and the number is uncomfortable.

Nearly Half of Companies Have Already Seen It Happen

Salt Security surveyed more than 380 security and technology professionals across technology, financial services, healthcare and manufacturing for its October 2026 research. 49.8% said they had confirmed or suspected that an AI agent took an action in the past 12 months that their organization did not intend, expect or authorize.

Those weren't trivial actions. Among the companies that saw one, more than half reported an unauthorized call to an outside system or an unauthorized transaction. More than 40% reported an agent that modified or deleted data.

And this is happening at scale. 86.4% of the organizations surveyed have at least one AI agent operating, and 59.5% run more than ten.

The Number That Should Worry You More Than the Incidents

The incidents are not the most important finding. This is: only 12.5% of organizations can consistently trace an agent's complete path, from the instruction it was given to the outcome it produced.

More than 60% said they would need hours or days of manual work to reconstruct what an agent did the previous day.

Read that again with the Monday morning scene in mind. When something goes wrong, most companies can't answer the first question anyone will ask. Not whether the agent made a mistake. Whether it was the agent at all.

That changes what an incident costs. A mistake you can trace is a fix. A mistake you can't trace is an investigation, and investigations take days, pull in people who were supposed to be doing other work, and often end without a clear answer.

What "Off-Script" Actually Looks Like

An agent going off-script rarely looks dramatic. It looks like normal work done for the wrong reason.

A clear example surfaced on October 1. Researchers at Salt Labs hid instructions inside an ordinary email, then asked Manus, a widely used AI agent, to check the inbox it was connected to. The agent read the email and ran the hidden code. Its built-in guardrail flagged the attempt, but only after the code had already executed.

From there, the researchers found credentials for the user's connected accounts, including Gmail, Google Drive and GitHub. This was a controlled research test on accounts the researchers owned, and the flaw has since been fixed. But the pattern matters more than the specific bug. The agent did exactly what agents are built to do: it read something, decided what to do, and acted. Nobody had to click anything.

Now picture that agent connected to your CRM, your ERP or your billing system. The question isn't whether every agent can be made perfectly safe. It's whether you would know, quickly and with evidence, when one wasn't.

Why Agents Are Harder to Account For Than People

AI agents are harder to audit than employees for three reasons: they chain actions together, they multiply quietly, and the logs most companies rely on were built for people.

They chain actions. 76.8% of organizations in the Salt research report agents that pass work across other agents, tools and systems. One instruction can turn into a dozen steps across five systems. If each system only records its own piece, nobody has the full story.
They multiply quietly. When most companies run more than ten agents, and new ones get set up by individual teams to solve immediate problems, the inventory goes stale fast. 32.9% of organizations found an unauthorized, shadow or misconfigured MCP server in the past year. MCP servers are the connectors that let an agent plug into tools and data, so an unknown one is an unknown door.
Their logs were built for humans. Most audit logs record that a user account did something. When an agent acts under a person's credentials or a shared service account, the log says the person did it. We covered the identity side of this problem in Why AI Agents Are Becoming Your Newest Insider Threat. Traceability is the next layer: even with the right identity, can you follow the chain of what happened?

How Do You Track What an AI Agent Is Doing?

You track an AI agent by recording its full chain of activity under a single ID, from the instruction it received to every system it touched to the result it produced. That only works if it's designed in before the agent goes live.

In practice, five things need to exist:

A record of the whole chain, not just the result. The instruction, each tool or system the agent called, the data it read or changed, and the outcome, all tied together so one search pulls the full story.
A named owner for every agent. Someone who knows what it's for, what it can touch, and who to call when it misbehaves. An agent without an owner is an agent nobody will notice until it causes a problem.
Permissions scoped to the job, not to the person who set it up. The Manus example worked because the agent inherited every account the user had connected. An agent that drafts emails doesn't need access to your code repository.
Human approval for anything that can't be undone. Payments, deletions, changes to customer or supplier records, messages sent outside the company. Let the agent prepare the action. Let a person confirm it.
A stop switch someone has actually tested. Only 17.5% of organizations can automatically stop an agent that's behaving unexpectedly in production. Most would have to step in manually or take the whole application offline.

None of these are exotic. They're the same disciplines good engineering teams already apply to payment systems and data pipelines. They just haven't been applied to agents yet, because agents arrived faster than the habits did.

This Is a Build Decision, Not a Policy

Most companies respond to research like this by writing a policy. Policies matter. But a policy that says "all agent actions must be auditable" does nothing if the agent was built without the plumbing to record them.

Traceability is an engineering property. It gets decided when the agent is designed: how actions are logged, where those records live, how they connect to the data the agent touched, and what happens when something needs to stop. Done at the start, it's simply part of the build. Retrofitted after an incident, it can mean rebuilding the integration from scratch.

It's the same shift that happened with data privacy. Regulators stopped accepting policy documents and started asking companies to prove what happened to specific data, which turned privacy into an engineering problem. We wrote about that in Data Privacy Just Became an Engineering Problem, Not a Legal One. Agents are heading down the same road, faster. The first time a customer, an auditor or your own board asks what an agent did and why, a policy won't be the answer they want. A record will.

The Five-Minute Test

Here's a simple way to find out where your company stands.

Pick one AI agent that's running in your business today. Ask the person responsible for it to show you everything it did yesterday: what it was asked to do, which systems it touched, what it changed, and why.

If they can show you in five minutes, you're in the 12.5%.

If it takes days, or nobody is sure who's responsible for it, that's not a reason to switch your agents off. It's the gap to close before you add the next one.

Common Questions About Tracking AI Agents

What is AI agent observability?

AI agent observability is the ability to see what an AI agent is doing while it runs and to reconstruct what it did afterward. It covers the instructions the agent received, the tools and systems it called, the data it read or changed, and the outcome. Good observability lets a team answer "what did this agent do and why" in minutes rather than days.

How do you audit an AI agent's actions?

You audit an AI agent by reviewing a complete, connected record of its activity: the original instruction, every step and system call it made, and the final result, all linked under one ID. That record has to be designed into the agent from the start. Standard application logs usually show only that an account made a change, not that an agent made it or what led to it.

Can you stop an AI agent that is misbehaving?

You can, if the stop mechanism was built and tested before the agent went live. Only 17.5% of organizations can automatically stop an agent behaving unexpectedly in production, according to October 2026 research from Salt Security. Most rely on someone noticing, then intervening manually or taking the entire application offline.