Reco has released The State of Agent Security 2026, a report combining Reco platform telemetry, an analysis of 500 published Model Context Protocol servers and disclosed vulnerability records that examines the adoption, capabilities, and security oversight of enterprise AI tools.
Based on Reco’s telemetry, four in five AI tools operate without IT oversight, leaving security teams without a clear view of which ones are active, who owns them or what access they hold. An analysis of 500 published agent tools found that 62% can both read local data and reach the Internet, creating a direct path for data exfiltration. Meanwhile, 525 of the 637 agent and LLM-tooling vulnerabilities tracked in the report were disclosed in the past 18 months, a more than sixfold increase in the average monthly disclosure rate compared with 2023 and 2024.
AI agents are not just another third-party application. They are increasingly embedded inside the ecosystem of tools employees use everyday, where they can inherit user permissions, OAuth grants, service accounts, and API access. The risk comes from unintended consequences of permission combinations: one tool can read files, another can reach the Internet, another can trigger a workflow, and together they grant agents the ability to move through the enterprise in ways no single application owner intended.
“AI agents have moved from experimentation into daily business workflows, but our findings show only 20% of AI tools in enterprise ecosystems are currently governed by IT oversight,” said Ofer Klein, CEO of Reco. “That leaves organizations exposed to a new class of operational risk. Agents embedded in applications can operate through existing permissions, OAuth grants and workflow access, creating toxic combinations that expose data and trigger actions beyond what any owner approved.”
Highlights from The State of Agent Security 2026
The report’s findings show that agent security risk is no longer limited to isolated AI tools; it now spans ungoverned adoption, inherited access, powerful default capabilities, toxic permission combinations, and a fast-growing exposure surface.
80% of AI tools run without IT oversight
Reco found that four in five AI tools operate without IT oversight. The report notes that sanctioned AI tools are often the most visible, including major chatbots and copilots inside approved software suites. The larger unmanaged risk sits in the long tail of automation frameworks, browser agents, and integration tools that can hold standing permissions and act independently.
62% of agent tools combine file-read and outbound network access
Reco analysed 500 published Model Context Protocol servers, which connect AI agents to data and actions. The report found that 62% combine local file-read access with outbound network connectivity in a single package. This combination can create an exfiltration path because the same tool may be able to read local data and transmit it externally.
Vulnerability disclosures have accelerated more than sixfold
The report tracked 637 vulnerabilities across agent and LLM tooling. Of those, 525 were disclosed in the past 18 months, including at least 111 rated critical with CVSS scores of 9.0 or higher. The average monthly disclosure rate increased from fewer than five during 2023 and 2024 to approximately 29 since January 2025, a pace that can outstrip normal patch and review cycles.
Agent tools are powerful by default
Among the 500 agent tools analysed, half could execute shell commands, more than eight in ten could read or write local files and roughly three-quarters could make outbound network calls. Those capabilities can be legitimate in isolation, but they become risky when combined with broad permissions, unsanctioned adoption, and weak oversight.
Unsanctioned AI adoption remains high
Reco found that 79% of third party applications are authorized, showing that many organizations have mature SaaS review programs. However, small and midsize companies carried 414 unsanctioned AI tools per 1,000 employees, showing that AI adoption can spread through browser extensions, OAuth consent screens, and employee-led workflows outside standard procurement and security review.
