Gartner Warns of Enterprise AI Agent Sprawl

Analyst firm Gartner presented warnings about widespread "agent sprawl" at its Digital Workplace Summit in London, saying enterprises face rapid growth in AI agents. According to Gartner, the average Global Fortune 500 enterprise is expected to run more than 150,000 AI agents by 2028, up from fewer than 15 today. Max Goss, senior director analyst at Gartner, said, "As CIOs and IT leaders see an explosion of AI agents across their organizations, many are contending with an ungoverned sprawl of agents."

According to Gartner's 2025 survey of 360 IT application leaders, only 15 percent of respondents said they were considering, piloting, or deploying fully autonomous AI agents, and just 13 percent of organizations believe they have the right governance in place overall. Gartner reported that half of surveyed organizations limited internal AI rollouts to low-risk or trusted users, and that broader adopters were 3.3 times more likely to report higher value from generative AI. The data also showed organizations that invested in third-party governance tools were nearly twice as likely to report higher value. Gartner described a governance model that uses a centralized committee and operational, domain-embedded teams to translate policy into controls.

Companies embedding large numbers of autonomous or semi-autonomous agents expand the attack surface for data leakage, error propagation, and API sprawl. Industry-pattern observations show that without centralized policy plus domain-level enforcement, discovery and lifecycle management of agents become operational bottlenecks. Tooling that provides inventory, audit trails, and access controls will be central to reducing misconfiguration risk and maintaining data provenance.

For practitioners, Gartner's findings align with broader reporting that enterprise AI adoption often outpaces governance maturity. Organizations that restrict access for risk reasons can reduce immediate exposure but may also limit measured value, a trade-off Gartner quantified in its survey results. Observers should treat governance work as cross-functional, requiring legal, security, architecture, and business input rather than a purely IT or security project.

Indicators to monitor include inventory accuracy for deployed agents, frequency of agent-initiated data exports, adoption rates of third-party governance platforms, and whether internal teams publish domain-specific control mappings. Public vendor announcements that add agent-tracking and control APIs to enterprise products will also affect how teams operationalize Gartner-style governance models.