Four in Five AI Tools Run with No IT Oversight, New Research Finds

Reco's "State of Agent Security 2026" warns that AI agents and Model Context Protocol (MCP) servers represent a rapidly expanding enterprise attack surface: around 80% of AI tools lack IT oversight, many MCP servers can execute shell commands, read/write files, and make outbound network calls, and researchers tracked 637 vulnerabilities (525 disclosed in 18 months) including 111 critical CVSS≥9.0, with disclosure rates rising sharply since 2025 — creating significant risk of data access, action-taking, and data exfiltration across organizations.