AI Agent Ecosystem Grows Riskier as Oversight Lags

Security researchers are urging enterprises to take a hard look at their AI agent ecosystems, after new data from a prominent vendor indicated that the vast majority of AI tools in use are running without any IT governance.

The findings, drawn from anonymized telemetry across large enterprises, public Model Context Protocol servers, and National Vulnerability Database disclosures, paint a picture of an agent landscape where operational risk is quietly accumulating.

80% of AI Tools Unmanaged

Reco, an AI security vendor, analyzed data from large enterprises and found that 80% of AI tools operate with no oversight. In small and medium-sized businesses, the situation is even more striking: an estimated 414 unsanctioned tools exist per 1,000 employees.

“AI agents have moved from experimentation into daily business workflows, but our findings show only 20% of AI tools in enterprise ecosystems are currently governed by IT oversight,” said Ofer Klein, CEO of Reco.

“That leaves organizations exposed to a new class of operational risk. Agents embedded in applications can operate through existing permissions, OAuth grants and workflow access, creating toxic combinations that expose data and trigger actions beyond what any owner approved.”

— Ofer Klein, CEO of Reco

MCP Servers: A Backdoor to Shell Access

The report also examined 500 MCP servers — the connective tissue that links AI agents to data and actions. The findings are alarming: exactly half of these servers can execute shell commands directly, which means a prompt-injection attack could escalate to full operating system access.

“More than eight in ten can read or write local files, and roughly three-quarters can make outbound network calls,” the report noted.

“These are the tools agents are built to load, by the thousands, often through a marketplace with no review step. They rarely guard themselves either: just over a quarter expose a network endpoint rather than running locally, and half of those ship no authentication at all, a remotely reachable tool with host-level reach and no lock on the door.”

62% Combine All Three Capabilities

Worse still, Reco found that nearly two-thirds (62%) of agents combine command execution, file access, and network egress in a single package. This combination can create an end-to-end toolkit to “find data, act on it, and move it off the machine,” Reco claimed.

Vulnerabilities Surge in Volume and Severity

The report tracked 637 vulnerabilities across agents and LLM tools. Of those, 525 were disclosed in the past 18 months, including at least 111 rated critical with CVSS scores of 9.0 or higher.

The average monthly disclosure rate rose from less than five during 2023 and 2024 to around 29 since January 2025. Reco warned that vulnerabilities are being published faster than patching programs can absorb.

Why Oversight Matters Now

The combination of unsupervised AI tools, vulnerable MCP servers, and a rising tide of critical disclosures suggests that the AI agent ecosystem is becoming an increasingly attractive target for attackers. For organizations, the stakes are clear: without proper governance, agents can inadvertently expose data or trigger actions beyond what any owner approved.

As Reco’s Klein put it, the toxic combinations of existing permissions, OAuth grants, and workflow access can lead to operational risks that many enterprises have not yet fully assessed. The report’s findings should serve as a wake-up call for IT and security teams to bring AI tools under management before the next wave of attacks exploits these gaps.