A new report indicates that a significant majority of AI tools within enterprise environments operate without IT oversight, contributing to an increasingly risky AI agent ecosystem. The study, conducted by AI security vendor Reco, analyzed anonymized platform telemetry from large enterprises, publicly available Model Context Protocol (MCP) servers, and vulnerability disclosures from the National Vulnerability Database.
The report, titled "The State of Agent Security 2026," found that 80% of AI tools lack IT governance. In small and medium-sized businesses (SMBs), the research estimated an average of 414 unsanctioned AI tools per 1000 employees. Reco's CEO, Ofer Klein, noted that while AI agents are now integrated into daily business workflows, only 20% of these tools in enterprise ecosystems are currently managed by IT, exposing organizations to new operational risks. He explained that agents embedded in applications can leverage existing permissions, OAuth grants, and workflow access, potentially creating "toxic combinations" that expose data and trigger unauthorized actions.
A particularly concerning finding from Reco's analysis of 500 MCP servers, which facilitate connections between AI agents and data or actions, revealed that half of these servers can directly execute shell commands. This capability could allow a prompt-injection attack to escalate to operating system access. Furthermore, over 80% of these servers can read or write local files, and approximately 75% can make outbound network calls. The report highlighted that these tools are often loaded by agents in large numbers, frequently through marketplaces without a review process. Only about a quarter of these tools expose a network endpoint rather than running locally, and half of those lack any authentication, creating remotely accessible tools with host-level reach and no security measures.
The study also found that nearly two-thirds (62%) of AI agents combine command execution, file access, and network egress capabilities in a single package. Reco warned that this combination provides an end-to-end toolkit for attackers to "find data, act on it, and move it off the machine."
In addition to oversight issues, the report tracked 637 vulnerabilities across AI agents and large language model (LLM) tools. Of these, 525 were disclosed within the last 18 months, including at least 111 critical vulnerabilities with CVSS scores of 9.0 or higher. The average monthly disclosure rate for these vulnerabilities has increased significantly, rising from fewer than five per month during 2023 and 2024 to approximately 29 per month since January 2025. Reco cautioned that vulnerabilities are being published at a pace that outstrips organizations' ability to implement patches.
