AI Agents Push Into Enterprise as MCP Security Flaws Pile Up

Agents are shipping faster than they can be controlled

This month's agent news points one way. Vendors are moving AI agents out of the demo stage and into production work. The protocol that links those agents to corporate tools keeps turning up security flaws. The industry's answer is to build controls into the infrastructure agents run on, rather than trusting the models to behave. Adoption is real, but the security and governance work is behind, and the companies that come out ahead will be the ones that treat agents as identities to be governed, not as features.

Adoption: big numbers that don't agree

The adoption figures vary widely, and the variation matters. WRITER's 2026 survey says 97% of executives deployed AI agents in the past year and that 52% of employees already use them12. First Page Sage puts agentic AI adoption at large enterprises (5,000+ employees) at 28%, up from 16% in 2025, with mid-market firms at 19% and small businesses at 13%11. Those numbers measure different things, not the same thing badly. Uvik Software notes that published surveys range from 52% to 82% adoption because some count casual use and others count deployment at scale. In one dataset it cites, only 2% of large organizations have fully scaled agents17.

The most reliable signal is how deep the deployments go. First Page Sage finds that 57% of adopting enterprises are still experimenting, and only 15% run agents fully deployed at scale11. McKinsey's August 2026 survey, as cited in a consulting firm's announcement, found that 40% of respondents at companies with more than $1 billion in revenue were scaling agents in at least one function, up from 27% in 2025. Smaller organizations stayed flat at 22%10. Usage among smaller firms is a different matter. OpenAI's October report on Europe says weekly active users of Codex or ChatGPT Work at EU small and mid-sized businesses grew 8.1x between May and early October. Much of that jump followed the July launch of ChatGPT Work16. One analyst rightly treats this as vendor data about vendor products: a strong usage signal, not independent proof16.

The results are mixed. In WRITER's data, 48% of respondents call AI adoption a massive disappointment, up from 34% the year before, and only 23% report significant returns from agents12. Federal agencies show the same pattern. In an ICF and MeriTalk survey, 45% of agencies run agentic AI in at least one production workflow, but only 10% say it matters operationally across the whole organization. Ninety-one percent name workflow redesign as the main obstacle19. In other words, the technology is ready before the organizations are.

Vendors are giving agents identities

The clearest product trend is that agents are being treated like employees, with their own credentials. Microsoft's Copilot Studio previews reportedly give agents separate Entra identities, their own Exchange mailboxes and a Teams presence. That lets them send email and join chats under credentials distinct from any human user13. Google says each of its Gemini agents gets a cryptographic identity, runs in an isolated sandbox and can be governed through an Agent Gateway, though those capabilities were not yet publicly available13. ServiceNow is pitching a runtime identity it calls "AI Passport." The idea is to enforce limits while the agent is running, not only through written policy13.

Forbes summarizes the wider field: Microsoft, Google, Salesforce, ServiceNow, Oracle and SAP all now sell agents that move between corporate systems and complete tasks. It also notes that software alone cannot decide how much authority an agent should have20. That is a fair caution. Identity features make an agent easier to audit and revoke. They do not settle what the agent should be allowed to do.

More specialized launches show where agents are actually taking on work:

• Finance: Kognitos released 61 role-based "AI employees" backed by 515 standard operating procedures, aimed at auditable, predictable work such as month-end close and KYC checks13.
• Fleet operations: Motive's agents call drivers, open maintenance work orders and escalate fleet issues on their own. Plain-language workflow creation is planned for early 20278.
• Notion: its rebuilt agent system can run a single task for more than 24 hours, up from five minutes, and routes work to cheaper models13.
• Telecom: Beyond Now's Wave AI Framework adds a control layer for orchestration, governance and observability over AI skills, MCP servers and APIs. Its CEO argues that building an agent is now easy and making it useful inside a business is the hard part27.

MCP: everyone uses it, and the flaws keep coming

The Model Context Protocol, which Anthropic released in November 2024, has become the default way to connect coding assistants and enterprise agent stacks to tools and data23. That success has made it a prime target. Security coverage this month mostly agrees on one diagnosis: the problems are not only scattered implementation bugs. They come from the protocol's trust model.

OX Security's scan of 15,465 public MCP servers found:

• No meaningful governance across registries.
• Some servers running on home machines exposed through tunneling services.
• More than 2% of hostnames that no longer resolve, some of them available to buy, which would let an attacker impersonate those servers2226.

OX also showed that once a user grants a single "always-allow" permission in Claude Code, a malicious server could follow a harmless file request with a request for sensitive files such as .env. No further approval prompt appeared. Anthropic's position was that this is documented behavior26.

The biggest dispute is OX's earlier finding about MCP's STDIO transport. In Anthropic's official SDKs, STDIO executes a command parameter without sanitizing it. OX estimates up to 200,000 vulnerable instances across a supply chain of more than 150 million downloads. Anthropic reportedly called the behavior intended and declined to change the protocol2223. A similar stance appeared this week. Pillar Security found a critical flaw in the OpenCode coding agent that let a malicious MCP server run code on Windows and WSL machines during sign-in. The vendor, Anomaly, fixed it quietly, did not request a CVE, and said user-configured MCP servers fall "outside our trust boundary"21. Without a CVE, vulnerability scanners cannot flag affected installs21.

Other recent findings:

• Python SDK: Cycode disclosed an OAuth flaw in Anthropic's official MCP Python SDK that could let a malicious server steal authorization codes and PKCE proofs and take over accounts. It is fixed in versions 1.30.0 and 2.2.027.
• Server-side request forgery: one researcher found the same SSRF flaw at Google, JPMorgan Chase and a French government directorate, all of which patched. Five US government servers, including one that logs veterans' Social Security numbers, remained unpatched six weeks after he reported them29.
• Academic fuzzing: the ToFu study found 253 verified vulnerabilities across 343 tools on 118 MCP servers. A recurring problem was tools that claim restrictions their code does not actually enforce30.

There is a real divergence in how blame gets assigned. Anthropic and some tool vendors put the burden on developers and users. Researchers argue that a specification with no normative security requirements guarantees the same mistakes will be rediscovered over and over29. The researchers have the stronger argument. When independent teams at a hyperscaler, a bank and a national government make the same error, the problem is the default, not the developers.

The response: open standards and runtime enforcement

Two efforts may begin to close the gap. First, governance of MCP has moved to a neutral body. The Agentic AI Foundation under the Linux Foundation now hosts it29. On October 22, the foundation added four projects: Anthropic's Agent Skills, OpenAI's Open Responses, Hugging Face's OpenEnv and Alibaba's OpenSandbox. That brings it to 10 projects, alongside MCP and the Agent2Agent protocol56. OpenSandbox in particular targets the execution-isolation problem the security research keeps exposing5.

Second, NVIDIA's OpenShell Reference Architecture, announced October 21, enforces policy in the infrastructure itself. It isolates agent workloads, routes credential requests through a supervisor, and uses BlueField-4 DPUs as an independent monitoring layer4. Even sympathetic coverage cautions that NVIDIA's security claims still need independent validation4.

The urgency is plain. A Salt Security survey found 87% of organizations run at least one agent and 60% run more than ten. Respondents reported agents making unapproved external API calls (54%), changing configurations or permissions (50%) and modifying or deleting data (42%)18. Another cited survey found only 44% of organizations have formal policies to secure the agents they use17. Gartner's forecast that more than 40% of agentic projects will be canceled by the end of 2027 now looks less like pessimism and more like a description of what happens to organizations that skip the governance work17.

The takeaway

In 2026, enterprise agents are no longer limited by whether models can do the work. They are limited by trust: who the agent is, what it can reach, and whether anyone can stop it mid-action. MCP made connecting agents to tools easy, and it also made mistakes spread easily. Until the specification adopts real security requirements, buyers should treat every MCP server as untrusted, and ask vendors for proof of runtime enforcement rather than policy documents.