About this report
Companies are giving AI agents real work: reading email, updating records, approving requests, calling other systems. An agent is software that does not just answer a question but takes steps on its own. That raises questions a COO ends up owning. Who is allowed to let an agent act? What can it touch? And why do analysts expect so many agent projects to be shut down? This report reviews research from 2025 and 2026 on those questions. It draws on analyst forecasts from Gartner, surveys from Deloitte, KPMG and SailPoint, a security standard from OWASP and public comments collected by the US National Institute of Standards and Technology (NIST). It is a review of other people's research, not a study of our own. Figures are quoted as the sources give them, and we say where a source sells products in this area or where a number is a forecast rather than a measurement.
Finding 1: Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027
In a press release dated 25 June 2025, Gartner predicted that over 40% of agentic AI projects will be canceled by the end of 2027. It named three causes: escalating costs, unclear business value and inadequate risk controls. Gartner analysts also said most agentic AI propositions lack significant value or return on investment, and that many use cases sold as agentic do not need an agent at all. They described "agent washing," where vendors relabel existing products as agents, and estimated that only about 130 of the thousands of agentic AI vendors are real.
Two cautions. This is a forecast by an analyst firm, not a count of projects that have already stopped. And Gartner's own site blocks automated fetching, so we read the release text as reproduced by a press mirror (W.Media) and checked the figures there. Read the release on gartner.com before quoting it in a board paper. Our reading: the useful point for a COO is the third cause. Inadequate risk controls sits next to cost and value as a reason projects end, so governance is a project risk, not only a compliance topic.
Finding 2: Adoption is running ahead of governance
Three separate surveys point the same way. SailPoint's 2025 report, AI agents: The new attack surface, surveyed 353 enterprise IT professionals across five continents (fielded by Dimensional Research). It found that 82% of organizations already run AI agents, yet just 44% have policies to secure them, while 98% plan to expand their use over the coming year. SailPoint sells identity security software, so treat this as a vendor survey.
Deloitte's State of AI in the Enterprise 2026 report surveyed 3,235 IT and business leaders in 24 countries between August and September 2025. Only 21% said their organization has a mature governance model for agentic AI, while 74% expect to use agents at least moderately by 2027. The two numbers come from the same survey, but they describe different things: the first is today's governance, the second is expected use.
KPMG's Q3 2026 AI Pulse, a survey of 314 US business and C-suite leaders whose organizations have at least $1 billion in annual revenue (fielded 24 July to 25 August 2026), found 62% of organizations were developing, deploying or building AI agents, compared with 53% the previous quarter. All three samples skew toward large organizations or IT staff, so mid-size firms should read them as a direction, not a benchmark.
Finding 3: Most organizations in one survey had already seen agents do things nobody intended
The same SailPoint survey reports that 80% of respondents said their agents had performed unintended actions. It broke that down: 39% said agents accessed unauthorized systems or resources, 32% said they downloaded sensitive content, and 31% and 33% were given for accessing or sharing sensitive or inappropriate data (the release lists both numbers on that one line, so we do not assign them to separate actions). 23% said an agent had been tricked into exposing access credentials. We read these figures in SailPoint's press release as reprinted by ITWire and in IT Brief's coverage; we did not open the full report PDF.
These are self-reported experiences from IT professionals in a vendor-commissioned survey, and the survey does not say how serious each event was. A harmless misrouted note and a data leak count the same in a headline percentage. Still, the direction is hard to dismiss: agents get tested in production, and some of what they do is unplanned.
Finding 4: The security standard blames too much functionality, permission and autonomy
OWASP, the open security community behind the widely used web-risk lists, ranks "Excessive Agency" as LLM06:2025 in its Top 10 for large language model applications. It defines it as a weakness that lets unexpected, ambiguous or manipulated model output trigger harmful actions, whether the cause is a mistake by the model or an attack that tricks it. It names three root causes:
Excessive functionality: the agent can use tools with functions it does not need.
Excessive permissions: those tools hold more rights in other systems than the job requires.
Excessive autonomy: high-impact actions are not independently checked or approved.
The fixes OWASP lists are plain: give the agent only the tools it needs, use narrow tools rather than open-ended ones such as a general shell, grant the lowest permissions, act in the context of the specific user, and require human approval for high-impact actions. It adds that the downstream system, not the model's own judgment, should decide whether an action is allowed. OWASP also notes that logging, monitoring and rate limits cannot stop excessive agency on their own, though they can reduce the damage. Our reading, in business terms: the question is less "how smart is the agent" than "what can it reach if it is wrong". Our guides on AI agent access control and human-in-the-loop AI turn these points into design choices.
Finding 5: Standards bodies want agents to have their own identity and short-lived access
In February 2026 the NIST National Cybersecurity Center of Excellence (NCCoE) published a draft concept paper on identity and authorization for software and AI agents and asked for comment (the comment period ran from 5 February to 2 April 2026). Its summary of the responses reports over 600 responses, with 614 shown in its chart; 70% (430) came from industry and 20% (123) from individuals. Themes the summary reports: most commenters agreed agents need distinct, verifiable non-human identities, though not how to build them; they favored stable trust anchors paired with short-lived, narrowly scoped credentials; they supported task-level authorization that narrows permissions as work passes from one agent to another; and they strongly preferred deterministic policy enforcement, with probabilistic analysis as support only. Commenters also expected very large numbers of short-lived agents, which multiplies the identities to manage and audit, and asked for audit records that capture why an action happened, not just what happened.
This is a public consultation, not a standard, and NIST says it will test whether existing standards can be extended. Our reading is that an agent should not borrow a shared admin login. It should have its own account, its own limits and a log that a person can read. Our agentic AI governance checklist for operations covers the ownership and review steps.
Finding 6: One rulebook for every agent fails in both directions
In a May 2026 press release, Gartner argued that applying uniform governance across all AI agents, regardless of autonomy and scope, can lead to enterprise agent failure. It predicts that by 2027, 40% of enterprises will demote or decommission autonomous agents because governance gaps were only found after production incidents. Gartner names two failure modes: over-restricting simple agents, which slows delivery and drives shadow development, and under-restricting autonomous ones, which raises operational, security and compliance risk. Its answer is a proportional model with autonomy levels, from read-only "observe" agents up to fully autonomous ones that need the strictest controls, such as circuit breakers that halt an agent when thresholds are crossed, rollback and clear ownership for agent behavior. As with Finding 1, we read the release as reproduced by a mirror (Insurance-Canada.ca) because gartner.com blocks automated fetching, and this too is a forecast. A separate April 2026 Gartner release on agent sprawl makes a similar point: if employees cannot work in sanctioned tools, they are likely to go around the controls.
KPMG's Q3 2026 data shows the proportional idea is not yet universal. 49% of leaders had defined high-risk use cases where agents may not make autonomous decisions, 73% were confident in their governance and capabilities (up from 57%), yet only 30% were putting controls inside their agents next to monitoring and evaluation, a fall from 43% two quarters earlier. Confidence rose while the share building controls fell, and the survey cannot tell us why.
What the evidence does not show
No source here measures how many agent projects were actually canceled. The Gartner figures are predictions.
SailPoint is a vendor survey of IT professionals, and its unintended-action results are self-reported with no severity scale.
Deloitte and KPMG samples lean toward large organizations. The KPMG main sample is 314 firms with at least $1 billion in revenue.
Surveys define "agent" differently, so adoption figures from different surveys are not directly comparable.
The NIST material is a consultation summary, not a finished standard.
We could not open the Gartner releases on gartner.com (the site blocks automated access) and read them as reproduced by press mirrors. We did not open the SailPoint report PDF.
What this means for a COO
The research points to a short list of questions to settle before an agent touches live systems. Who owns each agent and answers for what it does? What tools can it use, and with what permissions in each connected system? Which actions need a human to approve first? How do you see what it did, and how do you switch it off? Then match the controls to the agent: a read-only summarizer does not need the same review as one that can send payments or change customer records. That is the proportional approach Gartner describes and the least-privilege approach OWASP and the NIST commenters describe. Our view: a project that skips these questions will meet them later, in an incident review.
Where to start
If you are planning an agent or reviewing one already running, our team can map its access and approval points with you. Book a call to talk it over.
Sources
Gartner (2025). Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027. Press release, 25 June 2025.
Gartner (2026). Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure. Press release, May 2026 (read via mirror https://insurance-canada.ca/2026/06/19/gartner-governance-ai-agent-failure/).
Gartner (2026). Gartner Identifies Six Steps to Manage AI Agent Sprawl. Press release, 28 April 2026.
SailPoint (2025). AI agents: The new attack surface (survey of 353 IT professionals, conducted by Dimensional Research; vendor survey). Press release, 28 May 2025.
ITWire (2025). SailPoint Research Highlights Rapid AI Agent Adoption, Driving Urgent Need for Evolved Security (reprint of the press release).
IT Brief (2025). AI agents spark new enterprise security fears, report shows. Coverage of the SailPoint report, 29 May 2025.
OWASP (2025). LLM06:2025 Excessive Agency, OWASP Top 10 for LLM Applications.
NIST National Cybersecurity Center of Excellence (2026). Accelerating the Adoption of Software and AI Agent Identity and Authorization: draft concept paper, February 2026.
NIST NCCoE (2026). AI agent identity and authorization: summary of comments.
Deloitte (2026). The State of AI in the Enterprise, 2026 (3,235 leaders, 24 countries; fieldwork August to September 2025).
Deloitte Insights (2026). Business and IT leaders report AI agents are scaling faster than their guardrails, 24 April 2026.
KPMG (2026). AI Quarterly Pulse Survey, Q3 2026 (314 US leaders, fielded 24 July to 25 August 2026).