Four in five AI tools operate without AI oversight, according to new research from Reco, leaving security teams without a clear view of which ones are active, who owns them, or what access they hold.

Reco released The State of Agent Security 2026, combining Reco platform telemetry, an analysis of 500 published Model Context Protocol servers and disclosed vulnerability records that examines the adoption, capabilities, and security oversight of enterprise AI tools.

The report found that 80% of AI tools operate without IT oversight. Sanctioned AI tools are often the most visible, including major chatbots and copilots inside approved software suites. The larger unmanaged risk sits in the long tail of automation frameworks, browser agents and integration tools that can hold standing permissions and act independently.

The analysis also found that 62% of AI tools can both read local data and reach the internet, creating a direct path for data exfiltration.

Meanwhile, 525 of the 637 agent and LLM-tooling vulnerabilities tracked in the report were disclosed in the past 18 months, a more than sixfold increase in the average monthly disclosure rate compared with 2023 and 2024.

AI agents are not just another third-party application. They are increasingly embedded inside the ecosystem of tools employees use everyday, where they can inherit user permissions, OAuth grants, service accounts and API access.

Among the 500 agent tools analysed, half can execute shell commands, more than eight in ten can read or write local files and roughly three-quarters can make outbound network calls. Those capabilities can be legitimate in isolation, but they become risky when combined with broad permissions, unsanctioned adoption and weak oversight.

The risk comes from intended combinations: one tool can read files, another can reach the internet, another can trigger a workflow, and together they grant agents the ability to move through the enterprise in ways no single application owner intended.

“AI agents have moved from experimentation into daily business workflows, but our findings show only 20% of AI tools in enterprise ecosystems are currently governed by IT oversight,” said Ofer Klein, CEO of Reco.

“That leaves organisations exposed to a new class of operational risk. Agents embedded in applications can operate through existing permissions, OAuth grants and workflow access, creating toxic combinations that expose data and trigger actions beyond what any owner approved.”

Recommended reading

• OpenAI and Anthropic Called to White House Over AI Hacking Risks
• OpenAI Agents Communicated and Coordinated In Hugging Face Hack
• OpenAI Pauses AI Training Following Security Breaches

The report’s findings show that agent security risk is no longer limited to isolated AI tools; it now spans ungoverned adoption, inherited access, powerful default capabilities, toxic permission combinations and a fast-growing exposure surface.

It aso found that unsanctioned AI adoption remains high, finding that 79% of third party applications are authorised, showing that many organisations have mature SaaS review programmes. However, small and midsized companies are carrying 414 unsanctioned AI tools per 1,000 employees, showing how easily AI adoption can spread through browser extensions.