Analysis of 500 published MCP servers finds 62% combine local file-read access with outbound network connectivity; AI agent vulnerability disclosures are rising at more than six times the previous rate
ALTAMONTE SPRINGS, Fla., Aug. 26, 2026 (GLOBE NEWSWIRE) — Reco today released The State of Agent Security 2026, a report combining Reco platform telemetry, an analysis of 500 published Model Context Protocol servers and disclosed vulnerability records that examines the adoption, capabilities and security oversight of enterprise AI tools.
A full copy of the report is available here: https://www.reco.ai/state-of-agent-security-2026-form.
Based on Reco’s telemetry, four in five AI tools operate without IT oversight, leaving security teams without a clear view of which ones are active, who owns them or what access they hold. An analysis of 500 published agent tools found that 62% can both read local data and reach the internet, creating a direct path for data exfiltration. Meanwhile, 525 of the 637 agent and LLM-tooling vulnerabilities tracked in the report were disclosed in the past 18 months, a more than sixfold increase in the average monthly disclosure rate compared with 2023 and 2024.
AI agents are not just another third-party application. They are increasingly embedded inside the ecosystem of tools employees use everyday, where they can inherit user permissions, OAuth grants, service accounts and API access. The risk comes from intended combinations: one tool can read files, another can reach the internet, another can trigger a workflow, and together they grant agents the ability to move through the enterprise in ways no single application owner intended.
“AI agents have moved from experimentation into daily business workflows, but our findings show only 20% of AI tools in enterprise ecosystems are currently governed by IT oversight,” said Ofer Klein, CEO of Reco. “That leaves organizations exposed to a new class of operational risk. Agents embedded in applications can operate through existing permissions, OAuth grants and workflow access, creating toxic combinations that expose data and trigger actions beyond what any owner approved.”
Highlights from The State of Agent Security 2026
The report’s findings show that agent security risk is no longer limited to isolated AI tools; it now spans ungoverned adoption, inherited access, powerful default capabilities, toxic permission combinations and a fast-growing exposure surface.
80% of AI tools run without IT oversight
Reco found that four in five AI tools operate without IT oversight. The report notes that sanctioned AI tools are often the most visible, including major chatbots and copilots inside approved software suites. The larger unmanaged risk sits in the long tail of automation frameworks, browser agents and integration tools that can hold standing permissions and act independently.
62% of agent tools combine file-read and outbound network access
Reco analyzed 500 published Model Context Protocol servers, which connect AI agents to data and actions. The report found that 62% combine local file-read access with outbound network connectivity in a single package. This combination can create an exfiltration path because the same tool may be able to read local data and transmit it externally.
Vulnerability disclosures have accelerated more than sixfold
The report tracked 637 vulnerabilities across agent and LLM tooling. Of those, 525 were disclosed in the past 18 months, including at least 111 rated critical with CVSS scores of 9.0 or higher. The average monthly disclosure rate increased from fewer than five during 2023 and 2024 to approximately 29 since January 2025, a pace that can outstrip normal patch and review cycles.
Agent tools are powerful by default
Among the 500 agent tools analyzed, half can execute shell commands, more than eight in ten can read or write local files and roughly three-quarters can make outbound network calls. Those capabilities can be legitimate in isolation, but they become risky when combined with broad permissions, unsanctioned adoption and weak oversight.
Unsanctioned AI adoption remains high
Reco found that 79% of third party applications are authorized, showing that many organizations have mature SaaS review programs. However, small and midsize companies carried 414 unsanctioned AI tools per 1,000 employees, showing that AI adoption can spread through browser extensions, OAuth consent screens and employee-led workflows outside standard procurement and security review.
Methodology
Reco analyzed anonymized platform telemetry collected from 62 large enterprises across financial services, healthcare, retail/consumer, and telecommunications between Jan. 1, 2026 and Aug. 1, 2026. For this analysis, an AI tool was classified as operating without IT oversight when Reco observed it in use without IT or security approval. Reco also evaluated 500 publicly available Model Context Protocol servers selected from the public npm registry (keyword “mcp”, official SDK dependency, frameworks / gateways / clients removed, source confirmed to start a server) and reviewed vulnerability disclosures from the National Vulnerability Database (NVD) published from January 2025 through June 2026.
About Reco
Reco is the leader in Agent Ecosystem Security. The Reco Platform secures agents and their operating environments where applications, identities, permissions and workflows converge. It discovers an organization’s entire third-party ecosystem, prioritizes real risk over alert volume and remediates with precision across every human identity, agent, app and permission in the environment. The Reco Platform has more than 280 app integrations and 1,000 detection controls. Built on the Reco Graph, it delivers new integrations in hours through the Reco Factory and pre-built agent and app intelligence from the Reco Library. Security leaders at Fortune 500 enterprises choose Reco to bring order to agent proliferation and the chain reactions that follow. Learn more at reco.ai.
Media Contact
Marc Gendron
Marc Gendron PR for Reco
[email protected]
+1 617-877-7480
A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/93f9d964-031c-4fd4-acf0-ad86cff5ad5f
