Opsin has released the State of Agentic Adoption 2026 report from its research arm, Opsin Labs, analyzing enterprise production environments across eight verticals between March 2025 and June 2026. The report found that enterprise environments now average one AI agent for every employee, with workforce interactions growing 14x between January and June 2026 alone, while 60% of agents provisioned beyond default settings were granted allow-all access.
Enterprises now average one AI agent per employee, live or in draft mode.
Workforce interactions with AI agents grew 14x between January and June 2026.
67% of agents built by non-engineering employees (GTM, Customer Success, Operations).
60% of agents provisioned beyond default settings had allow-all access instead of scoped permissions.
60% of agents had configured capabilities exceeding original stated intent.
Report outlines four common attack paths from agents with excessive access and limited human checkpoints.
Enterprise environments now average one agent, live or in draft mode, for every employee, with workforce interactions with AI agents growing 14x between January 2026 and June 2026 alone. 67% of agents are being built by employees without engineering background like GTM, Customer Success, and Operations, often outrunning the provisioning discipline security teams rely on to scope access safely. Opsin Labs also found that 60% of agents provisioned beyond default settings were granted allow-all access rather than being scoped to the permissions their tasks required. 60% of agents were judged to have configured capabilities that exceeded their original stated intent.
The report outlines four common attack paths observed by Opsin Labs tracing back to the same pervasive theme in enterprise environments today: agents provisioned with more access than their job requires, and limited to no human checkpoints before they act. The findings highlight that looking for abnormal or risky behavior after the agent is live is a step too late. Understanding agent intent with full context is the underpinning behavior baselining needs to identify risk.
"Agent creation outran security review months ago, and most of the associated risk traces back to provisioning choices that were never revisited. Looking for abnormal or risky behavior after the agent is live is a step too late. Understanding agent intent with full context is the underpinning behavior baselining needs to identify risk. Governance has to catch up," said James Pham, CEO and Co-Founder, Opsin.
About Opsin
Enterprise AI has crossed a threshold. Agents can reason, plan, inherit user identities, and act across sensitive systems, and governance must now account for intent, context, and behavior. Opsin is a purpose-built platform that gives enterprises rapid visibility and complete context to govern agents across what they can access, what they do, and when behavior deviates from intended use. Opsin discovers agents operating across platforms in SaaS, cloud, and enterprise environments; builds a complete context graph connecting identity, data, and model access; and identifies overshared sensitive data, misaligned access, and anomalous behavior before risk becomes an incident. Opsin is trusted by customers such as Barry-Wehmiller, Culligan, UiPath, Ethos, Sauers, and more.
