AIBRIEF
Reco's audit of 500 AI agents finds 62% can both read local files and reach the open internet, a path procurement reviews were not built to catch.
Four in five AI tools now running inside companies sit outside IT review, per Reco's State of Agent Security 2026 report. Most of the audited agents carry a risk older security playbooks were not built to handle.
The audit reviewed 500 agent-style tools: the autonomous browser and workflow assistants that act on a user's behalf. 62% of those agents can both read local files and reach the open internet at the same time, TechRadar Pro reports. That combination is the exfiltration path procurement was built to miss.
At smaller companies, Reco counted 414 AI tools per 1,000 employees without IT sign-off, driven by browser extensions and Model Context Protocol (MCP) connectors that bypass the SaaS procurement line that catches ordinary subscriptions. Across telemetry from 62 enterprise-scale businesses in financial services, healthcare, retail, and telecom, Reco tallied 637 vulnerabilities between January 1 and August 1, 2026, per SC World.
The findings reproduce across multiple outlets: CIO Influence cites the same 80%, TechRadar Pro too. The underlying dataset remains Reco's own; no independent auditor has re-run the 500-tool check. The procurement gate that catches SaaS is not built to catch agents, and that gap is now measurable.