A company can spend years building a careful process for approving software. Then an employee installs an AI browser extension, clicks through an OAuth consent screen, and gives it access to their inbox, files, or calendar in a few minutes.
New research from Reco suggests this is happening at a considerable scale. The company, which helps to secure AI agents for enterprises, found that 79% of SaaS applications across its telemetry are authorised, suggesting that traditional software governance is working reasonably well. Yet at small and midsize companies, Reco also found 414 unsanctioned AI tools for every 1,000 employees. Across all the AI tools it observed, four in five operated without IT oversight.
AI agents make those numbers harder to dismiss as another case of employees downloading unapproved software. A writing app might sit in a browser tab waiting for a prompt. An agent could be connected to an inbox, customer database, or code repository, with permission to carry out tasks there long after the person who installed it has moved on.
Knowing an application exists, then, only tells part of the story. Security teams also need to understand what it can reach once someone lets it through the door.
The AI Tools Nobody Is Watching
Shadow IT predates ChatGPT by decades. Employees have always found their own tools when the company-approved option was too slow, too difficult, or simply unavailable. Agents bring something different to that old problem: autonomy.
Reco describes browser agents that summarise inboxes, workflow tools wired into customer records, and coding assistants with repository access. Some hold standing permissions instead of waiting for someone to prompt them every time they act.
Those permissions can remain active even after the employee who originally connected the tool changes roles or leaves the company. And this does not require anyone to deliberately bypass corporate security. An employee may simply connect a useful tool to Google Drive or a CRM and approve the permissions it requests. In other words, while the application never passed through procurement, it now has a key to part of the business.
That problem is attracting attention beyond security vendors. In February, the U.S. National Institute of Standards and Technology launched a project focused specifically on AI agent identity and authorisation, including how organisations identify agents, control what they are authorised to do, and audit their activity.
Half of Agent Tools Can Execute Shell Commands
Reco also examined 500 published Model Context Protocol (MCP) servers to see what agent tools can actually do. MCP is a standard that allows AI systems to connect with external tools and data. It is what can turn an AI assistant from merely answering questions to interacting with files, applications, and other systems.
Half of the MCP servers Reco analysed could execute shell commands directly. More than eight in ten could read or write local files, while 73% could make outbound network calls. Forty percent combined all three capabilities. Consider what that combination looks like from an employee’s desk. A useful AI tool can read a file because that is part of its job. It can connect to the internet because that is also part of its job. Neither permission necessarily looks alarming on its own.
Put them together, and the same tool has a route from information on the machine to somewhere outside it.
Reco found that 62% of the tools it studied combined local file access with outbound network access. It describes these overlaps as “toxic combinations,” where permissions granted for legitimate reasons create a much larger exposure when combined.
OWASP has raised similar concerns around MCP, warning that delegated permissions, overly broad access, and chained tools can increase the impact of a single vulnerability. Its guidance recommends restricting MCP servers to the minimum permissions needed for their jobs.
525 Vulnerabilities in 18 Months
There is another important finding in Reco’s research. Of the 500 agent tools it examined, 96% were first published within the past two years. Reco also counted 525 vulnerabilities disclosed across agent and large language model tooling during the past 18 months. At least 111 were rated critical.
The implication is that companies are connecting a remarkably young class of software to some of the systems they care about most. And that means the first major work these companies have to do is finding those connections. Which agents are running? Who installed them? Which accounts and applications can they access? Are those permissions still necessary six months later?
Reco recommends maintaining an inventory of agents, integrations, and OAuth grants and regularly reviewing the permissions attached to them. The NIST is arriving at a similar principle from the standards side. Its latest guidance argues that agents should be treated as distinct identities, with their own credentials and permissions, rather than simply borrowing those of the humans who use them.
That may be the more revealing way to read Reco’s 79% figure. A company can have most of its software neatly catalogued and approved, while hundreds of AI tools quietly sit outside that process. The software inventory might say everything is under control. But the permissions tell you what is actually happening.
