New Research Finds Four in Five AI Tools Run Without IT Governance

The Governance Gap Is Larger Than Most Teams Expect

Reco analyzed anonymized telemetry from large enterprises, publicly available Model Context Protocol (MCP) servers, and vulnerability disclosures from the National Vulnerability Database. The headline finding: 80% of AI tools operating inside enterprise environments run without any IT oversight.

In smaller organizations, the problem compounds differently. The report estimates 414 unsanctioned AI tools per 1,000 employees in SMBs—a figure that reflects how quickly individuals and teams adopt tools outside any formal procurement or review process.

This is the shadow IT problem, restated for the agent era. The difference is that AI agents don’t just store or display data—they act on it.

Why MCP Servers Raise the Stakes

The report’s analysis of 500 Model Context Protocol servers is where the findings become structurally concerning. MCP servers are the connective layer between AI agents and the data or systems they interact with. What Reco found in that layer:

• 50% can execute shell commands directly
• More than 80% can read or write local files
• Roughly 75% can make outbound network calls
• ~25% expose a network endpoint rather than running locally
• Of those, half ship with no authentication

Shell execution, file access, and network egress are individually significant capabilities. The report finds that nearly two-thirds of agents—62%—combine all three in a single package. That combination creates what Reco describes as an end-to-end toolkit: find data, act on it, move it off the machine.

The mechanism for exploitation doesn’t require sophisticated intrusion. A prompt-injection attack against an agent with shell access becomes, in effect, operating system access. The agent’s existing OAuth grants and workflow permissions do the rest.

Vulnerabilities Are Accumulating Faster Than Patches

The report tracked 637 vulnerabilities across agent and LLM tools. Of those, 525 were disclosed within the past 18 months. At least 111 carry CVSS scores of 9.0 or higher—the critical threshold.

The disclosure rate tells its own story. Monthly disclosures averaged fewer than five during 2023 and 2024. Since January 2025, that figure has risen to approximately 29 per month.

Reco’s conclusion is direct: vulnerabilities are being published faster than enterprise patching programs can absorb them. That gap between disclosure velocity and remediation capacity is not a temporary condition—it reflects the structural reality of a rapidly expanding tool surface.

What This Means for Teams Deploying Agents

The risk profile described in this report isn’t theoretical. It follows directly from how AI tools are currently being adopted: quickly, often by individual contributors or business units, and without the review steps that would apply to other enterprise software.

A few practical implications stand out:

OAuth grants accumulate silently. Agents embedded in existing workflows inherit permissions that were never scoped for autonomous action. Reviewing what access has been granted—and to what—is a necessary first step, not a future project.

MCP marketplaces have no mandatory review step. Tools are loaded by agents, often in large numbers, from sources that carry no authentication requirement. Treating MCP servers as trusted by default is an assumption the data doesn’t support.

The unsanctioned tool count is almost certainly underestimated. If large enterprises have 80% of tools running without oversight, the actual inventory is likely larger than any current asset register reflects.

The useful takeaway here isn’t that AI agents should be avoided—it’s that the governance infrastructure most organizations built for SaaS adoption hasn’t kept pace with how agents actually operate. Closing that gap requires visibility first, policy second. Right now, most organizations don’t yet have the visibility.