Security researchers have raised alarm bells regarding significant deficiencies in information technology oversight, an escalating number of publicly disclosed vulnerabilities, and the associated risks linked to Model Context Protocol (MCP) security. These vulnerabilities pose substantial threats to the increasingly complex ecosystem of artificial intelligence (AI) agents.
A recent analysis conducted by Reco, a security vendor specializing in AI, sheds light on these pressing concerns. The report, titled The State of Agent Security 2026, is based on a thorough examination of anonymized telemetry data from large enterprises, publicly available MCP servers, and vulnerability disclosures sourced from the National Vulnerability Database. Through this investigation, Reco has uncovered alarming trends that could greatly affect organizational security.
According to the findings, a staggering 80% of AI tools are operating without any form of IT oversight. This lack of governance is even more pronounced in small and medium-sized businesses (SMBs), where it is estimated that there are approximately 414 unsanctioned AI tools for every 1,000 employees. Ofer Klein, the CEO of Reco, emphasized the severity of the situation, stating, “AI agents have transitioned from experimentation to becoming integral components of daily business workflows. However, only 20% of these tools within enterprise ecosystems are currently governed by IT oversight.” This shortfall, Klein argues, exposes organizations to a new category of operational risk.
The risks associated with ungoverned AI agents are further highlighted by their capability to operate via existing permissions, OAuth grants, and workflow access. This creates potentially dangerous scenarios wherein harmful combinations of actions can occur, leading to unauthorized data access and actions that exceed what any owner would have approved.
The lack of oversight becomes even more alarming when examining Reco’s analysis of 500 MCP servers, which are essential in linking AI agents to the data and actions they require. The report reveals that exactly half of these servers possess the ability to execute shell commands directly, transforming a relatively simple prompt-injection flaw into a pathway for operating system access. More than 80% are capable of reading or writing local files, and roughly three-quarters can initiate outbound network calls.
The implications of these findings are profound. Reco stresses that these tools are often loaded by agents in large quantities, frequently through marketplaces devoid of any rigorous review process. Alarmingly, these tools also provide minimal inherent security measures. Just over a quarter of them expose a network endpoint as opposed to functioning locally; and of those exposed, half lack any form of authentication. This exposes a critical vulnerability—a remotely reachable tool with extensive host-level access and no safeguards against unauthorized entry.
The situation becomes even more dire when considering the functionality of these agents. Reco discovered that nearly two-thirds (62%) of the agents surveyed are capable of combining command execution, file access, and network egress within a single package. According to Reco, this potent combination equips the agents with an end-to-end toolkit capable of "finding data, acting on it, and moving it off the machine." This functional breadth markedly increases the risk of data breaches and cybercrimes.
In addition to the operational concerns surrounding unregulated AI agents, the report tracked a total of 637 vulnerabilities linked to these agents and Large Language Model (LLM) tools. Notably, 525 of these vulnerabilities were disclosed within the last 18 months, including at least 111 classified as critical, with Common Vulnerability Scoring System (CVSS) scores of 9.0 or higher. The statistics reveal a troubling trend: the average monthly rate of vulnerability disclosures has surged from fewer than five in 2023 and 2024 to approximately 29 since January 2025.
Reco warns that the speed at which vulnerabilities are being disclosed far exceeds the capacity of existing patching programs to address them effectively. This situation presents a formidable challenge for organizations looking to secure their AI systems, revealing an urgent need for enhanced oversight, better security protocols, and more comprehensive patch management processes. As the realm of AI continues to evolve, so too must the strategies employed to safeguard it from increasingly sophisticated and dangerous threats.