Reco Report Highlights Oversight Gaps and Risks in AI Agent Tools
Summary
Reco’s 2026 report combines company telemetry with analysis of 500 public MCP servers, reporting widespread lack of IT oversight, risky tool capabilities, and 525 agent and LLM-tooling vulnerabilities disclosed in 18 months.
Key points
- Reco reports 414 unsanctioned AI tools per 1,000 employees at small and mid-size firms, and says four in five AI tools in its telemetry lack IT oversight.
- In an analysis of 500 public MCP servers, Reco found half could run shell commands and more than 80% could read or write local files.
- Reco says 62% of the analyzed tools combined local data access with outbound network access, which could enable data exfiltration.
- The report counts 525 vulnerabilities in agent and LLM tooling disclosed over 18 months, including at least 111 rated critical.
- Reco recommends inventorying agents and OAuth grants, reviewing permissions, vetting marketplace tools, monitoring behavior, and enabling one-action access revocation.
- The report also cites OpenClaw’s CVE-2026-25253, malicious skills found on ClawHub, and leaked agent tokens at Moltbook as examples of emerging risks.
Article Details
- Publisher
- Reco
- Report Period
- Vulnerability record begins in January 2025; events referenced through May 2026.
- Scope
- Reco SaaS telemetry and analysis of published agent tools and vulnerabilities in the agent and LLM-tooling ecosystem.
- Sample Size
- 500 published MCP servers analyzed; Reco telemetry sample size not disclosed.
- Key Statistics
- Small and mid-size firms had 414 unsanctioned AI tools per 1,000 employees, according to Reco platform telemetry.
- Four in five AI tools in Reco telemetry operated without IT oversight.
- Half of the 500 MCP servers examined could execute shell commands on the host.
- 62% of the 500 MCP servers examined could read local data and make outbound network calls.
- 525 vulnerabilities were disclosed in the agent and LLM-tooling ecosystem over 18 months; at least 111 were rated critical (CVSS 9.0+).
- Recommendations
- Inventory agents, integrations, and OAuth grants, and assign each a named owner.
- Review agent permissions and revoke unused scopes; gate marketplace skills behind review before installation.
- Audit AI tools active for 60 or more days, especially those holding OAuth grants.
- Map combinations of data access and outbound egress across tools and connected systems.
- Maintain a live inventory and one-action access revocation capability, and test revocation in a live drill.
CVE
Vendors
Products
ClawHub| **Feb 2026** | ClawHub: 12% of skills malicious | Agent marketplaces are an unvetted supply chain |Moltbook| **Feb 2026** | Moltbook: 1.5M agent tokens leaked | Agent tokens are wearable identities at scale |OpenClaw| **Jan 2026** | OpenClaw remote code execution (CVE-2026-25253) | One malicious webpage hijacks an autonomous agent |Reco Platform| **414 unsanctioned AI tools per 1,000 employees** | Reco platform telemetry | AI tools seen without IT approval, normalized per 1,000 employees at small and mid-size firms |