I've seen spies standing around doing nothing, too. I think 2 things are at work here: 1) the AI doesn't know how to skill up its spies and assassins, and 2) the AI will avoid trying something that is almost certain to fail. It doesn't always, though. I had one general in my Spanish campaign that was up to something like a +8 to personal security and +2 to public security from all the failed French assassination attempts against him.