Security Reports disagree 2 publishers 3 min read Published Aug 27, 2026, 5:28 AM PDT

Reco puts 80% of employee AI tools outside IT oversight against 21% of SaaS

The oversight ratio comes from one vendor's platform telemetry and should be read as such, but the capability data underneath it is checkable, and half of the 500 MCP servers sampled from npm can execute shell commands.

The Watch · Security desk

Send a correction

Illustration accompanying Reco puts 80% of employee AI tools outside IT oversight against 21% of SaaS — Generated illustration

What happened

Reco's State of Agent Security 2026, published Wednesday, reports 80% of AI tools running ungoverned in customer environments while 79% of SaaS applications at the same organisations were authorized.
Across 500 MCP servers pulled from npm, 50% can execute shell commands, 82% can read or write local files, and 73% can make outbound network calls.
Just over a quarter of those servers expose a network endpoint and half of those ship with no authentication, which Reco puts at roughly one in eight of the sample reachable remotely with host-level reach.
Reco counted 637 AI tool vulnerabilities in the National Vulnerability Database since 2023, 525 of them in the past 18 months, including 111 rated CVSS 9.0 or higher.

Why it matters

Who's exposed exposure About one in eight of the sampled MCP servers can be reached over the network with no credential and act on the host, which removes the phishing step an attacker would otherwise need.
What doesn't add up contradiction The two published readings of the same report differ on whether 62% describes file-plus-network or the full trifecta, and on a 500-server sample that is a 110-server swing in what a capability rule would block.
What it costs cost A programme absorbing 29 AI disclosures a month is reviewing roughly one a day, with six of them critical, and that queue lands on the same team asked to inventory the ungoverned tools.
Who has to decide decision If agents inherit permissions and OAuth grants that already exist, discovery belongs in the identity layer, and endpoint-based shadow IT tooling will keep returning a clean answer.

Next story · Product · Sep 29

Reco takes $55 million into an agent security market where two dozen vendors sound alike

Confirmed6 publishers

The capability numbers are the part that does not depend on Reco's customer list. An MCP server is loaded into an agent as a tool, so whatever the agent reads becomes input to whatever the tool can do. Half of the 500 npm servers sampled can execute shell commands ^[5], which is what converts an indirect prompt injection in a ticket or a fetched web page into a process on the host. Reco's own framing names those toxic combinations as a path to file exfiltration and further compromise ^[7]. The two counts that matter for writing a rule are file access and egress, and that is where the two published accounts diverge.

SC Media reports 40% of the sample with the full trifecta of shell execution, local file access and network egress, and 62% combining file and network access ^[19]. Infosecurity Magazine attributes the 62% to the trifecta itself ^[20]. On a 500-server sample that is 200 servers against 310, a 110-server difference in what a capability-based blocklist catches ^[21].

The vulnerability counts hold together better. Reco tracked 637 since 2023, 525 of them in the past 18 months, 111 at CVSS 9.0 or above ^[9]. 525 over 18 months is 29.2 a month ^[14], which matches the roughly 29 monthly since January 2025 that Reco reports ^[10]. The remaining 112 spread across 2023 and 2024 comes to 4.7 a month ^[15], consistent with the sub-five baseline. The critical subset runs 6.2 a month, one every 4.9 days ^[18], which is what Reco means by every few days ^[16]. Its conclusion is that disclosure is outpacing patch programmes ^[23].

What the telemetry is worth depends on who generated it. Reco sells AI security and the ratio comes from its own platform ^[6]^[1]. Infosecurity describes the input as anonymised telemetry from large enterprises ^[6], while the figure of about 414 unsanctioned AI tools per 1,000 employees is attributed to small and mid-size firms ^[4]. Neither account gives a tenant count or a definition of a tool. The 80-against-21 split is at least an internal comparison, two populations counted by the same product ^[13]; the per-employee absolute is not portable to your own estimate.

Reco's remediation loop is discover, map, detect, revoke, with OAuth grants showing 60 or more days of activity triaged first ^[11], marketplace skills vetted after 12% of skills on ClawHub, the OpenClaw marketplace, were found malicious ^[22], and a kill switch per agentic tool ^[12]. CEO Ofer Klein's stated concern is that embedded agents work through permissions, OAuth grants and workflow access that already exist ^[17], which puts discovery in the identity inventory rather than the endpoint inventory. A per-agent revocation path is the cheapest item on that list and earns its keep at any oversight ratio.

What to watch

Whether Reco publishes the tenant count and the definition of a tool behind the 80% figure.
Whether the no-auth network endpoints in the npm sample start appearing in exploitation reports rather than capability audits.
Whether the AI disclosure rate holds near 29 a month through 2026 or the 111 criticals draw sustained attacker attention.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence54
Adoption58
Hype gap+28
Incentives82
Confidence57

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
The report draws on Reco's platform telemetry, an analysis of 500 MCP servers available on npm, and a review of AI tool vulnerabilities from the National Vulnerability Database.
Reported SupportedView cited source
[2]
Reco published its report The State of Agent Security 2026 on Wednesday.
Reported SupportedView cited source
[3]
Reco found that 79% of all SaaS applications at organizations were authorized, while 80% of AI tools, including browser extensions and MCP servers, were ungoverned.
Reported SupportedView cited source
[4]
Small and mid-size companies averaged about 414 unsanctioned AI tools running per 1,000 employees.
Reported SupportedView cited source
[5]
Of 500 MCP servers analysed, 50% enable agents to execute shell commands, 82% enable local file reads and writes, and 73% support outbound network calls.
Reported SupportedView cited source
[6]
Infosecurity Magazine describes Reco as an AI security vendor that analysed anonymized platform telemetry from large enterprises, publicly available MCP servers and NVD disclosures.
Reported SupportedView cited source
[7]
The report emphasized that toxic combinations of capabilities can enable file exfiltration and further system compromise through prompt injection attacks.
Reported SupportedView cited source
[8]
Just over a quarter of MCP servers exposed a network endpoint and half of those endpoints required no authentication out of the box, which Reco described as a remotely reachable tool with host-level reach and no lock on the door for about 1 in 8 of the tools.
Reported SupportedView cited source
[9]
Reco identified 637 AI-related vulnerabilities in the NVD since 2023, 525 of them disclosed in the last 18 months, of which 111 had a critical CVSS score of 9.0 or higher.
Reported SupportedView cited source
[10]
The average monthly disclosure rate rose from fewer than five during 2023 and 2024 to around 29 since January 2025.
Reported SupportedView cited source
[11]
Reco recommended discovering AI tools and every identity and integration attached to them, prioritizing those with OAuth grants showing 60 or more days of activity.
Reported SupportedView cited source
[12]
Reco recommended a kill switch for each agentic tool discovered so access can be rapidly revoked during an incident, as part of a discover, map, detect, revoke loop.
Reported SupportedView cited source
[13]
The unauthorized share of SaaS is 21%, against 80% of AI tools ungoverned, a ratio of about 3.8 to 1.
Derived Supported
[14]
525 disclosures over 18 months averages 29.2 per month.
Derived Supported
[15]
The 112 disclosures outside the last 18 months average 4.7 per month across the 24 months of 2023 and 2024.
Derived Supported
[16]
Reco characterised the critical AI vulnerability rate as averaging one every few days.
Reported SupportedView cited source
[17]
Reco CEO Ofer Klein said agents embedded in applications can operate through existing permissions, OAuth grants and workflow access, creating toxic combinations that expose data and trigger actions beyond what any owner approved.
Reported Supported Source: Ofer Klein, CEO of RecoView cited source
[18]
111 critical disclosures over 18 months is 6.2 per month, or one every 4.9 days.
Derived Supported
[19]
SC Media's account of the report states that 40% of MCP servers allowed a full trifecta of shell command execution, local system access and network egress, while 62% combined file and network access.
Reported ContestedView cited source
[20]
Infosecurity Magazine's account states that 62% of agents combine command execution, file access and network egress in a single package.
Reported ContestedView cited source
[21]
On the 500-server sample, 40% is 200 servers and 62% is 310 servers, a difference of 110 servers between the two published readings.
Derived Contested
[22]
Reco noted that 12% of skills found in ClawHub, the OpenClaw marketplace, were previously found to be malicious.
Reported InsufficientView cited source
[23]
Reco warned that vulnerabilities are being published faster than patching programs can absorb.
Reported InsufficientView cited source

Sources

2 independent publishers whose own reporting we read for this story.

infosecurity-magazine.com
1 article · August 26, 2026
Four in Five AI Tools Run with No IT Oversight, New Research Finds
scworld.com
1 article · August 27, 2026
Shadow AI surges as 80% of employee AI tools evade IT oversight

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

For anyone shipping or installing MCP servers, the checkable half of this report is the interesting half: of 500 servers pulled from npm, 50% can execute shell commands, 82% read and write local files, 73% make outbound network calls, and roughly one in eight is remotely reachable with host-level reach and no authentication out of the box. That is a default-permissions story about a package ecosystem, not a vendor opinion, and it means a prompt-injection bug in an agent that loads such a server is an operating-system problem. SC Media supplies the granular splits and the npm provenance; Infosecurity paraphrases the same percentages. Note the unresolved discrepancy on how many servers carry all three capabilities — 40% by one account, 62% by the other — before quoting either figure in a design review.

Operator

The operational headline is an inventory gap: Reco's telemetry puts 80% of employee AI tools — browser extensions and MCP servers included — outside IT governance, against 79% of SaaS applications authorized, and about 414 unsanctioned AI tools per 1,000 employees at small and mid-size firms. Alongside it sits a disclosure curve, 637 AI vulnerabilities in the NVD since 2023 with 525 in the last 18 months and 111 rated critical, moving from under five a month in 2023-24 to about 29 since January 2025. The prescribed response is concrete enough to act on: discover every tool plus its attached identities and integrations, prioritize OAuth grants with 60-plus days of activity, trim excess scopes, vet marketplace skills, and keep a per-tool kill switch. The oversight percentages are one vendor's telemetry with no disclosed sample size or definition of 'governed', and the claim that disclosures outrun patching capacity comes with no patch-throughput data, so treat the ratio as directional and the capability audit as the actionable part.

Investor

This is a category-sizing artifact from a security vendor rather than a market datapoint: no funding, pricing, customer counts or revenue figures appear in either account. What it establishes is that an AI-governance vendor now has telemetry-based numbers to argue that shadow AI oversight is roughly four times worse than shadow IT, and that the remediation loop it recommends — discovery, permission mapping, scope revocation, kill switch — maps onto its own product surface. The MCP capability scan of 500 npm packages is the reusable, independently repeatable asset here; the 80%/79% oversight split is proprietary and unverifiable from the cluster. Read it as evidence of demand framing in agent security, not as measured adoption of any product.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence54: 0100
Checkable capability scan bolted to unverifiable telemetry
The report has two evidentiary halves of very different quality. The MCP leg rests on a defined, publicly repeatable sample — 500 servers on npm — and the NVD leg reproduces arithmetically: 525 disclosures over 18 months is 29.2 per month and 111 criticals is one every 4.9 days, matching the published characterizations. The headline oversight ratio, by contrast, comes from proprietary vendor telemetry with no disclosed sample size, tenant count or definition of a 'governed' tool, and the two accounts disagree on how many servers combine all three capabilities. No incident data ties the capability findings to observed exploitation.
Adoption58: 0100
Agent tooling widely in place, governance controls not evidenced
The cluster does contain quantified deployment signals: agents described as moved from experimentation into daily workflows, roughly 414 unsanctioned AI tools per 1,000 employees at SMBs, 80% of AI tools outside oversight, and 500 MCP servers available on npm with permissive default capabilities. All of it, however, is one vendor's measurement of one customer base plus a package-registry sample; there is no named enterprise deployment, no independent usage disclosure, and zero evidence of uptake for the recommended controls (kill switches, scope revocation, OAuth activity triage).
Hype gap+28: −100 understated0 aligned+100 overstated
Headline ratio outruns the evidence behind it
The framing that drives both headlines — four in five AI tools ungoverned, shadow AI outpacing shadow IT roughly four to one — rests entirely on undisclosed vendor telemetry produced by a company selling the remedy, and is presented without methodology caveats by either outlet. The capability and vulnerability findings underneath are more solid and arguably undersold, but the risk narrative jumps from capability presence to end-to-end exfiltration toolkits without a single documented incident, and one of the load-bearing combination figures is reported two different ways. Modestly overstated rather than fabricated.
Incentives82: 0100
Vendor sizes the gap its own product closes
Every headline number originates with Reco, an AI security vendor, and the report's prescribed loop — discover tools and attached identities, map permissions, detect, revoke, keep a kill switch, triage OAuth grants with 60-plus days of activity — describes precisely the capability set such a platform sells. The CEO is quoted framing the risk class. The npm and NVD legs draw on public data and are therefore less incentive-loaded, but the ungoverned-share statistic that both outlets led with is derived from the vendor's own telemetry, and neither publisher flags the commercial interest.
Confidence57: 0100
Two secondary accounts of one primary vendor source
Both cluster sources are established security trade publications reporting within a day of release, and they agree on the core figures for oversight, capability prevalence, unauthenticated endpoints and vulnerability counts — which raises confidence that the report says what is attributed to it. But there is only one primary source behind everything, no independent replication of any number, an unresolved 22-point discrepancy on the capability-combination metric, and two claims (ClawHub malicious skills, patching absorption) that the cluster cannot substantiate at all.

Topics and entities

Topics

AI Vulnerability Disclosure Trends
MCP Server Security
Agent Identity and OAuth Scope
Vendor Research Methodology
Shadow AI Governance
Prompt Injection and Data Exfiltration