Skip to main content

Reco releases State of Agent Security 2026 findings on agent oversight

Source Decision Insights Record Published August 26, 2026 Companies 1
Human View Machine View

6th article in the last 90 days, one of 9 articles referencing Recorded Future. Previous coverage: Reco to Present Sessions on AI Agent Security Exposure at Black Hat USA and DEF CON 34 (Aug 2026).

Companies mentioned

Best suited for

Seniority
C Level / Executive Team
Job function
Chief Information Security Officer
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Decision stage
Which to buy
Adoption curve
Early Adopters
Technology maturity
Market Correction
Industry
Information Technology / Cybersecurity / Exposure, Risk & Governance / Governance, Risk & Compliance (GRC) & Security Ratings

Our classification, not the publisher's statement. Best suited for, not only for.

Reco released “The State of Agent Security 2026,” a report that reviewed how AI agents and related tooling are adopted and governed. The findings focus on where governance gaps appear and how agent capabilities intersect with disclosure activity, using analysis of published servers and vulnerability records.

According to the report’s Reco telemetry, four in five AI tools operated without IT oversight. Reco said it observed those tools in use without IT or security approval, and it also analyzed how agent tooling can access local data while maintaining outbound network connectivity.

Reco’s review of 500 published Model Context Protocol servers found that 62% combined local file-read access with outbound network connectivity. Reco also tracked 637 vulnerabilities across agent and LLM tooling, and said 525 were disclosed in the past 18 months, describing this as more than a sixfold increase in the average monthly disclosure rate compared with 2023 and 2024.

“AI agents have moved from experimentation into daily business workflows, but our findings show only 20% of AI tools in enterprise ecosystems are currently governed by IT oversight,” said Ofer Klein, CEO of Reco. “That leaves organizations exposed to a new class of operational risk. Agents embedded in applications can operate through existing permissions, OAuth grants and workflow access, creating toxic combinations that expose data and trigger actions beyond what any owner approved.”

Reco said the report incorporated anonymized platform telemetry from 62 large enterprises collected between Jan. 1, 2026 and Aug. 1, 2026, and that it also reviewed vulnerability disclosures from the National Vulnerability Database published from January 2025 through June 2026.

Press release, provided by Globe Newswire on behalf of Recorded Future. Read the original.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/reco-releases-state-of-agent-security-2026-findings-on-agent-oversight/",
        "name": "Reco releases State of Agent Security 2026 findings on agent oversight",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/reco-releases-state-of-agent-security-2026-findings-on-agent-oversight/#blogposting",
    "@type": "NewsArticle",
    "about": {
      "@id": "https://decisioninsights.ai/registry/recorded-future/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/recorded-future/",
      "name": "Recorded Future"
    },
    "articleSection": [
      "Cybersecurity",
      "AI infrastructure",
      "Network Operator"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "C Level / Executive Team"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Chief Information Security Officer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Adopters"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Market Correction"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Cybersecurity / Exposure, Risk & Governance / Governance, Risk & Compliance (GRC) & Security Ratings"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-signals/#person",
      "@type": "Person",
      "name": "Decision Insights Record",
      "url": "https://decisioninsights.ai/author/decision-insights-signals/"
    },
    "dateModified": "2026-08-26T10:34:46-06:00",
    "datePublished": "2026-08-26T10:34:43-06:00",
    "description": "Reco’s “State of Agent Security 2026” report analyzes 500 Model Context Protocol servers and vulnerability disclosures, finding 80% of AI tools lack IT oversight.",
    "headline": "Reco releases State of Agent Security 2026 findings on agent oversight",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@type": "Organization",
        "name": "GlobeNewswire"
      },
      "url": "https://www.globenewswire.com/news-release/2026/08/26/3351417/0/en/reco-finds-four-in-five-ai-tools-operate-without-it-oversight-in-state-of-agent-security-2026-report.html"
    },
    "keywords": [
      "AI Agents",
      "Connectivity",
      "Telemetry",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/reco-releases-state-of-agent-security-2026-findings-on-agent-oversight/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-26",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/recorded-future/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/recorded-future/",
        "name": "Recorded Future"
      },
      {
        "@id": "https://decisioninsights.ai/projects/oauth/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/oauth/",
        "name": "OAuth"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-signals/#person",
    "@type": "Person",
    "description": "Press releases and independent analyst research, structured into concise summaries for research and monitoring. Produced under our Standards & Methodology.",
    "name": "Decision Insights Record",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-signals/"
  }
]

Is this your company? Get structured data for your own pages