Loading story…
Reco’s State of Agent Security 2026 found that 80% of enterprise AI tools operate without IT oversight, with SMBs estimated to use 414 unsanctioned AI tools per 1,000 employees. The ungoverned deployments create material visibility, identity, access-control, and data-exfiltration risks as employees connect AI services and agents to enterprise data and systems outside established security controls.
Reco’s review of 500 npm-hosted Model Context Protocol (MCP) servers found many exposed remotely without authentication and capable of shell execution, local-file access, and outbound network connections—permissions that prompt-injection attacks could abuse to steal data or compromise systems. The company also identified 637 vulnerabilities affecting AI agents and LLM tools, including 525 disclosed in the previous 18 months and at least 111 rated critical; it urged organizations to inventory AI tools and integrations, reduce unnecessary OAuth scopes, vet marketplace tools, and retain an emergency kill switch for each agentic tool.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Reco released its State of Agent Security 2026 report, based on enterprise telemetry, an analysis of 500 npm-hosted MCP servers, and National Vulnerability Database records. The report found that 80% of enterprise AI tools operated without IT oversight and highlighted risky MCP server capabilities and growing AI-related vulnerability disclosures.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026
Security leaders are warning that **AI agents are increasingly operating as “digital employees”** inside enterprise workflows—triaging alerts, coordinating investigations, and moving work across security tools—often with **broad permissions and limited governance**. The core risk highlighted is that organizations are deploying high-authority agents like plug-ins (reused service accounts, overbroad roles, weak oversight), creating fast-acting operators that can be manipulated and that lack the contextual judgment and policy awareness expected of human staff. Related commentary also raises concerns about **AI-to-AI communication** and “non-human-readable” behaviors that could reduce auditability and complicate investigations and control enforcement. In parallel, public examples show how quickly AI can accelerate **vulnerability discovery**: Microsoft Azure CTO Mark Russinovich reported using *Claude Opus 4.6* to decompile decades-old Apple II 6502 machine code and identify multiple issues, underscoring that similar techniques could be applied to **embedded/legacy firmware at scale**. Anthropic has also cautioned that advanced models can find high-severity flaws even in heavily tested codebases, reinforcing the likelihood that both defenders and attackers will leverage AI for faster bug-finding. Separate enterprise IT coverage notes that organizations are **reallocating budgets toward AI** by consolidating tools and renegotiating contracts, which can indirectly increase security exposure if cost-cutting reduces overlapping controls or if AI adoption outpaces governance and identity/access management maturity.
Jun 29, 2026
Security researchers and media reporting highlighted widespread **public exposure of self-hosted AI infrastructure** caused by rushed, poorly governed deployments. Reporting cited **14,000+ internet-accessible Ollama inference servers**, with one analysis estimating **~20%** hosting models susceptible to unauthorized access, and separate findings identifying **10,000+ Ollama servers** exposed **without any authentication**—often due to developers binding services to all interfaces or standing up local inference/gateway components (e.g., *LiteLLM*, *vLLM*) outside normal asset inventories. The net effect is “shadow AI” that creates material blind spots for security teams and increases the likelihood of unauthorized model access, data exposure, and abuse of internal AI services. In parallel, enterprise adoption of **Model Context Protocol (MCP) servers**—which bridge LLMs to internal tools and data—has introduced similar exposure risk when deployed without access controls. Guidance and analysis noted that MCP, introduced as an open standard without native role restrictions, leaves security implementation to operators; researchers reportedly identified **nearly 2,000 MCP servers** on the open web with **no security controls**, increasing risk of unauthorized access, data loss, and potentially **arbitrary command execution** via overly privileged integrations. A vendor announcement positioned an AI-agent governance platform (*MintMCP*) as a response to these visibility and control gaps (audit trails, policy enforcement, access controls), but it primarily serves as product marketing rather than independent incident reporting.
Jul 12, 2026