The capability numbers are the part that does not depend on Reco's customer list. An MCP server is loaded into an agent as a tool, so whatever the agent reads becomes input to whatever the tool can do. Half of the 500 npm servers sampled can execute shell commands [6], which is what converts an indirect prompt injection in a ticket or a fetched web page into a process on the host. Reco's own framing names those toxic combinations as a path to file exfiltration and further compromise [22]. The two counts that matter for writing a rule are file access and egress, and that is where the two published accounts diverge.
SC Media reports 40% of the sample with the full trifecta of shell execution, local file access and network egress, and 62% combining file and network access [7]. Infosecurity Magazine attributes the 62% to the trifecta itself [8]. On a 500-server sample that is 200 servers against 310, a 110-server difference in what a capability-based blocklist catches [9].
The vulnerability counts hold together better. Reco tracked 637 since 2023, 525 of them in the past 18 months, 111 at CVSS 9.0 or above [11]. 525 over 18 months is 29.2 a month [13], which matches the roughly 29 monthly since January 2025 that Reco reports [12]. The remaining 112 spread across 2023 and 2024 comes to 4.7 a month [14], consistent with the sub-five baseline. The critical subset runs 6.2 a month, one every 4.9 days [15], which is what Reco means by every few days [16]. Its conclusion is that disclosure is outpacing patch programmes [23].
What the telemetry is worth depends on who generated it. Reco sells AI security and the ratio comes from its own platform [21][2]. Infosecurity describes the input as anonymised telemetry from large enterprises [21], while the figure of about 414 unsanctioned AI tools per 1,000 employees is attributed to small and mid-size firms [5]. Neither account gives a tenant count or a definition of a tool. The 80-against-21 split is at least an internal comparison, two populations counted by the same product [4]; the per-employee absolute is not portable to your own estimate.
Reco's remediation loop is discover, map, detect, revoke, with OAuth grants showing 60 or more days of activity triaged first [18], marketplace skills vetted after 12% of skills on ClawHub, the OpenClaw marketplace, were found malicious [19], and a kill switch per agentic tool [20]. CEO Ofer Klein's stated concern is that embedded agents work through permissions, OAuth grants and workflow access that already exist [17], which puts discovery in the identity inventory rather than the endpoint inventory. A per-agent revocation path is the cheapest item on that list and earns its keep at any oversight ratio.
