This review compares four documents published in late August 2026, with NCSC and OWASP guidance as context. They use different methods: a vendor-sponsored survey, telemetry and package analysis from one vendor, cloud guidance, and reporting on a broader adoption survey. Read the figures within each sample; guidance documents do not independently confirm survey results.
Four documents, one gap
The survey. EMA for Cequence Security, Agents Without Guardrails: The Agentic AI Governance Gap in the Enterprise, August 31, 2026: 202 IT and security leaders at organizations with 1,000 or more employees.
The telemetry. Reco, The State of Agent Security 2026, August 26, 2026: telemetry from 62 large enterprises, January 1 to August 1, 2026, plus 500 published MCP servers on npm and NVD data to June 2026.
The vendor's position. Microsoft, AI agent shared responsibility model, August 26, 2026.
The adoption curve. McKinsey, The State of AI in 2026, August 25, 2026, 1,719 respondents, cited through The Register with the underlying survey not independently reviewed for this article.
Two more bracket the week: the UK NCSC's Managing the cyber risk of agentic AI (August 20) and OWASP's 2026 Top 10 for LLM Applications with a new Agent Control Standard (September 1).
The numbers
Adoption. 40% of McKinsey respondents at organizations above 1 billion dollars in revenue are scaling AI agents, up from 27% a year earlier.
Out of scope actions. 65% have had an agent act outside its intended scope, 29% with measurable business impact. 32% contained it within minutes; 54.5% needed hours and manual intervention.
Authorization at the moment of action. 34% evaluate an agent's authorization at the moment it attempts a specific action.
Confidence versus practice. 94% are confident their agents have no more access than they need. 33% provision least privilege.
Audit and inventory. 46% could not produce a complete audit trail of agent activity over 30 days. 47% lacked a reliable agent inventory.
The MCP surface. Of 500 MCP servers on npm, 62% combine local file read with outbound network connectivity; half can run shell commands, more than eight in ten read or write local files and roughly three quarters make outbound calls. Four in five AI tools in Reco's telemetry run outside IT oversight.
The vulnerability rate. Reco tracks 637 vulnerabilities across agent and LLM tooling, 525 disclosed in the past 18 months, at least 111 critical. The monthly rate went from fewer than five in 2023 and 2024 to roughly 29 since January 2025, the pattern we see in the CVE record.
| Indicator | Reported result | Evidence source |
|---|---|---|
| Scaling AI agentsOrganizations with more than $1B in revenue | 40%Up from 27% a year earlier | McKinsey, via The Register ↗Survey: 1,719 respondents overall |
| Agents acting out of scope | 65%29% reported measurable business impact | EMA / Cequence ↗Survey: 202 IT and security leaders |
| Authorization checked per action | 34%Check authorization when an action is attempted | EMA / Cequence ↗Survey: 202 IT and security leaders |
| Confidence and least privilege | 94% / 33%Confident about access / provision least privilege | EMA / Cequence ↗Survey: 202 IT and security leaders |
| Gaps in audit trails and inventory | 46% / 47%No complete 30-day audit trail / no reliable agent inventory | EMA, via Infosecurity ↗Survey: 202 IT and security leaders |
| AI tools outside IT oversight | 4 in 5Tools operating without IT oversight | Reco ↗Telemetry from 62 enterprises |
| MCP servers with file and network access | 62%Combine file reads and outbound connectivity; 50% can run shell commands | Reco ↗Analysis of 500 MCP servers on npm |
| Agent and LLM tooling vulnerabilities | ~29/monthSince January 2025; fewer than 5 per month in 2023–2024 | Reco ↗NVD records through June 2026 |
What the vendors now say
Read Microsoft's model as a requirements list. Regardless of deployment model the customer retains "Authorization of actions: what the agent is allowed to do, especially irreversible or sensitive operations." The tools and actions layer asks for least privilege per tool, "Authorization on every action, not only at session start," approval gates for irreversible actions, sandboxing with egress control and "Action auditing. Log every tool invocation with inputs, outputs, the identity used, and the decision rationale." The page closes: "Autonomy never reduces accountability."
The NCSC says it in plainer English: "humans approve actions before they happen," every agent gets its own unique identity, the network is deny by default with allowlists, "logs should be immutable so you can trust them during an investigation" and you should always be able to "pull the plug."
OWASP's 2026 Top 10 is the first edition weighed against real incident data, and the risk where the ranking and the record agree most clearly is Excessive Agency, at number three. The Agent Control Standard donated the same day extends the project's work "toward practical runtime enforcement."
A cloud vendor, a national security agency and a standards body now name the same controls. Set them next to the survey: per action authorization, 34%; least privilege per tool, 33%; unique agent identities enforced, 54.5%; a complete 30 day trail, missing at 46%.
"The gap is between what's written down and what's enforced when an agent takes an action nobody approved." Christopher M. Steffen, VP of Research at EMA
Where the gap actually is
Written versus enforced. Steffen's own reading is that the gap "isn't a lack of awareness; most organizations have policies in place and express real confidence in them." A policy document does not stop a tool call. Something in the execution path has to apply the policy. The 34% response does not establish that all remaining organizations lack authorization: it measures the specific practice asked about in that survey.
Session start versus each action. The survey reports that 34% evaluate authorization when an agent attempts a specific action. That identifies a useful review question, not proof that every other respondent relies only on session approval. Check resource and parameter permissions at the application or enforcement point, including after the agent has read untrusted material.
Confidence versus evidence. The survey reports high confidence alongside gaps in least privilege, inventory and audit trails. These percentages answer different questions; they do not show that the same respondents account for each gap. Test confidence against the access and records in your own environment. When 62% of servers can read files and reach the network, an out of scope action is a potential exfiltration path, and "what did it touch" needs evidence, not memory.
What this means for defenders
- Inventory agents as capabilities, not names. 47% have no reliable inventory. For every agent, list the servers, skills and tools it can reach and what each can do: files, shell, network, credentials.
- Move the authorization check to the moment of action. 34% do this. A deployment-time review does not establish that every later request stays within scope. Evaluate it deterministically per tool call, in the execution path, deny by default.
- Measure least privilege instead of surveying it. Compare stated confidence with measured permissions in the deployment. Give every agent its own identity, diff the scopes it holds against the scopes it used in the last 30 days and review unused permissions before revoking them; infrequent legitimate tasks may need an explicit exception.
- Keep per-call records for the review periods your organization requires. In the survey, 46% could not produce a complete 30-day trail. Record the identity, decision, policy version and relevant inputs and outcomes. Minimize or redact sensitive content, control access and test retrieval against the agreed retention period.
- Treat MCP servers and skills as suppliers with a disclosure rate. Roughly 29 vulnerabilities a month and 62% of published servers with a file to network path make the approved list a living document. Pin by content, grade before first use, review again on change.
This is the shape of what we build. Oktsec Control applies policy to supported actions routed through configured enforcement points and records signed action evidence. Oktsec Signal reviews MCP servers, skills and packages. Recurring reviews and the changes that trigger them are defined in the engagement scope.
The evidence supports reviewing inventory, least privilege and audit readiness. It does not quantify the maturity of all enterprises or prove that one technical control closes every governance gap. Implementation, ownership and the quality of the policy all matter.
Sources
- EMA for Cequence Security, Agents Without Guardrails: The Agentic AI Governance Gap in the Enterprise, press release, August 31, 2026.
- Infosecurity Magazine, 65% of Enterprises Have Seen AI Agents Act Out of Scope, September 1, 2026, for the audit trail, inventory and containment figures.
- Reco, The State of Agent Security 2026, press release, August 26, 2026.
- Microsoft Learn, AI agent shared responsibility model, August 26, 2026.
- The Register, McKinsey says enterprise AI is finally "on the road to ROI", August 25, 2026, reporting McKinsey's The State of AI in 2026. The McKinsey primary did not load when this was written.
- UK National Cyber Security Centre, Managing the cyber risk of agentic AI, August 20, 2026.
- OWASP GenAI Security Project, 2026 Top 10 for LLM Applications and Agent Control Standard announcement, September 1, 2026.