69% of Enterprises Share API Keys for AI Agents, VentureBeat Research Finds

AI Agent Security Compromised by Shared API Keys in Majority of Enterprises

New research from VentureBeat, published in June 2026, reveals a critical vulnerability in enterprise AI deployments. The study, surveying 107 companies, found that a significant 69% of organizations use shared API keys across multiple AI agents. This practice creates substantial security gaps, as a single compromised agent can grant attackers access to all associated workflows and accumulated permissions.

This security exposure is a driving force behind recent cybersecurity acquisition trends. Major players like Palo Alto Networks, CrowdStrike, and Cisco have collectively invested over $22 billion in the past year on acquisitions targeting this specific layer of vulnerability. Palo Alto Networks acquired CyberArk for $21.1 billion, CrowdStrike purchased SGNL for $740 million, and Cisco intends to acquire Astrix Security for approximately $400 million.

The survey highlights that only 32% of enterprises provide each AI agent with its own unique, scoped identity. The majority of organizations either share keys or use borrowed credentials from human or service accounts, complicating attribution and risk management.

Furthermore, over half (54%) of respondents have already experienced an AI agent-related security incident or near-miss. While security teams often manage to stop these events at the last control point, the research underscores the breadth of these vulnerabilities. Many companies monitor and log agent activity, but only 30% sandbox their highest-risk agents, a key control for preventing a single compromised agent from affecting the entire deployment.