Enterprise AI Agents Create Inventory, Identity and Governance Gaps, Island Says

Summary

Island argues that enterprise AI agents create gaps in inventory, identity, attribution and oversight. Its research reports security findings in MCP servers and malicious repositories, and recommends real-time governance and just-in-time access.

Key points

Island reports scanning 33,563 published MCP server builds containing 475,865 tools; nearly half had at least one security finding.
Island says about one in eight scanned builds exposed a tool capable of code execution, data deletion or another irreversible action on its first call.
The article says agent activity can be difficult to distinguish from human actions in logs, complicating attribution and audit trails.
Island's team reports finding roughly 7,600 malicious GitHub repositories, including more than 800 posing as AI Skills or MCP servers, in a campaign delivering the StealC information stealer.
The article recommends live inventories of agents and their capabilities, distinct agent identities, and just-in-time access scoped to individual tasks.
It advocates inline checks of prompts, tool calls and returned data, plus usage and cost monitoring based on actual sessions and tool calls.

Article Details

Topic: Enterprise AI agent security governance, including agent inventory, identity attribution, inline controls, and malicious repository discovery.

Malware

StealC#Island

Vendors

IslandWe laid out how we are building for exactly this, across the browser, the endpoint, and the network, in Expanding Island to Govern your AI Workforce.

Industries

financeA security leader at a global finance company told us recently that his team discovered three times more AI tools running in their environment than IT had approved.GovernmentOver the past year, in customer discussions across finance, healthcare, manufacturing, and government, the same four struggles come up so consistently that we have started treating them as the shape of the problem HealthcareOver the past year, in customer discussions across finance, healthcare, manufacturing, and government, the same four struggles come up so consistently that we have started treating them as the shape of the problem ManufacturingOver the past year, in customer discussions across finance, healthcare, manufacturing, and government, the same four struggles come up so consistently that we have started treating them as the shape of the problem