Lurking in many business environments are AI agents that pose serious security risks but, for the most part, remain out of sight of security teams, according to a report released Wednesday by a global SaaS security company.
AI agents now read inboxes, file tickets, write code, and move records between applications under standing OAuth grants, the report by Reco noted, and most arrived the way unsanctioned AI always has: one consent screen at a time, with no security review.
The 16-page report, based on Reco telemetry on AI tool use in the enterprise, an analysis of 500 Model Context Protocol (MCP) servers, and public vulnerability records, pointed out that an attacker who gets into a chatbot sees whatever employees pasted into it, while one who gets into an agent inherits everything it was permitted to reach, at machine speed, under a non-human identity an organization created but never personally meets.
While acknowledging that most SaaS applications are authorized in businesses, the report found that small and mid-size companies carry 414 unsanctioned AI tools per 1,000 employees.
Shadow AI Spreads Outside IT Oversight
“Employees use unsanctioned agents because they solve immediate work problems, like summarizing an inbox or connecting a workflow to a CRM,” explained Reco CEO Ofer Klein.
“The employee may see that as a productivity gain, not as introducing a security risk into the company’s environment,” he told TechNewsWorld.
He added that “shadow AI” tools often enter the business without a security review, but still gain access to sensitive company data and systems, often through a browser extension or OAuth consent screen, outside the normal procurement and review process.
“At smaller companies, the volume is especially concerning because these tools may be able to reach the same payroll, customer and source-code systems they would at a much larger enterprise, but with fewer people watching,” he said.
Dave Hayes, vice president of product at FusionAuth, a maker of customer identity and access management software in Broomfield, Colo., noted that unsanctioned apps used to be a data problem, but AI agents are far more dangerous, even when they’re not rogue.
“Agents connect to multiple systems and attempt to achieve their goal regardless of human rules, whereas a user-installed app would connect to a single system and break if it couldn’t do its job,” he told TechNewsWorld.
Access Without Governance
Reco also reported that four out of five AI tools run without IT oversight.
“A tool with no IT oversight is a tool with no policy attached to it — no record of what data it can touch, no way to revoke its access when a project ends and no audit trail if something goes wrong,” explained Ron Longo, CEO of TrustLogix, a data security and access governance company in Mountain View, Calif.
“At scale, that adds up to a large, invisible footprint of standing access across the business that nobody is actively managing,” he told TechNewsWorld.
Jacob Krell, senior director for secure AI solutions and cybersecurity at Suzu Labs, a provider of AI-powered cybersecurity services in Las Vegas, pointed out that the ungoverned share is exactly where autonomous agents operate.
“An employee can configure an AI agent inside a platform such as Salesforce or Microsoft 365 without creating the procurement trail associated with a new application,” he told TechNewsWorld. “Depending on how the integration is set up, that agent may inherit the platform’s existing access permissions and continue operating autonomously, potentially long after the employee who configured it has left the company.”
“If those credentials and permissions are not inventoried, organizations end up with long-lived machine access nobody is actively governing,” he said.
Shell Access Raises Stakes
Reco’s researchers also analyzed 500 published MCP servers and found that half could run shell commands on the host machine.
“This is arguably the most alarming finding from a pure infrastructure standpoint,” observed Jeff Collins, CEO of WanAware, an IT-infrastructure observability and asset-inventory company in Boulder, Colo.
“The MCP is designed to give AI models access to local environments, but allowing an AI to run shell commands is effectively remote code execution,” he told TechNewsWorld.
“The security challenge here is the risk of indirect prompt injection and compromised supply chains,” he explained. “If an attacker can manipulate the inputs to an AI model by sending an employee a malicious document that the AI summarizes, they could trick the AI into executing malicious shell commands on the host machine.”
“Because AI already has authorization, the attacker instantly gains a foothold in the corporate network to move laterally, install ransomware or exfiltrate data,” he said.
High-Value Target
The MCP finding should be a wake-up call for anyone treating MCP as a lightweight integration layer, argued Arti Raman, CEO of Portal26, an enterprise AI visibility company in San Jose, Calif.
“If that server is compromised, misconfigured, or manipulated through a malicious prompt, an attacker isn’t just extracting information; they can potentially execute arbitrary commands with whatever privileges that server holds,” he told TechNewsWorld.
“At scale, that turns agentic AI infrastructure into one of the highest-value targets in the enterprise,” he explained, “and most organizations don’t yet have the visibility or controls in place to treat it that way.”
“People are installing these from GitHub repos with a handful of stars, no code review, and no vendor behind them,” added Russell Spitler, co-founder and CEO of Nudge Security, a SaaS and AI security provider in Austin, Texas.
“We’d never accept that for any other category of software with this level of access,” he told TechNewsWorld, “but it’s happening at scale because the installation happens outside IT’s field of view.”
Reco also identified 525 vulnerabilities in agent and LLM tooling disclosed during the past 18 months, including at least 111 rated critical, with a Common Vulnerability Scoring System score of 9.0 or higher.
The report warned that the young, fast-moving agent-tool ecosystem is producing vulnerabilities faster than conventional patch cycles can absorb them.
Shift in Governance
Reco’s researchers also found that 62% of the published agent tools analyzed can read local data and transmit it over the internet in one package.
“Read plus export in a single tool collapses the distance between access and loss,” explained Itai Schwartz, co-founder and CTO of Mind, an AI-native data security company in Seattle.
“A tool like that doesn’t need to be hacked to hurt you,” he told TechNewsWorld. “It just needs a prompt that convinces it to do its job with the wrong data.”
“The data it reaches is usually the debt every organization carries, years of unclassified sensitive files now readable by agents IT never vetted,” he said. “Once an agent packages and ships that data, it’s gone at machine speed.”
“The pattern behind every stat in this report is the same,” he added. “Organizations are pointing unvetted agents at years of accumulated sensitive data nobody ever classified.”
The broad shift organizations must make is from governing what AI can generate to governing what AI can do, maintained Ryan McCurdy, vice president of marketing at Liquibase, a database-change automation company in Austin, Texas.
“As agents get access to more tools, credentials and production systems, security can’t stop at the model,” he told TechNewsWorld. “Governance has to follow the action all the way to the system being changed.”
“It has to operate at the speed of AI,” he continued. “Adding more tickets and manual approvals every time an agent wants to do something defeats the reason enterprises are adopting agents in the first place.”
.jpg "Apple doubles down on desktop AI with new Mac offerings")