Key points
- Nearly half of scanned AI inventories contain references to models scoring in the critical range.
- Environments using agents and MCP servers show significantly higher rates of high-scoring model references.
- Risk scores reflect tested exposure under basic guardrails, not necessarily active production vulnerabilities.
New research from Snyk reveals that nearly half of enterprise AI inventories reference models with critical risk scores, a finding that demands immediate attention from managed service providers and security leaders. The study, part of the 2026 State of Agentic AI Adoption series, analyzes thousands of scanned environments to determine how model risk correlates with application reach and tool access. This data provides a crucial baseline for organizations managing connected software estates, emphasizing that a model’s inherent risk score is only one component of the overall security posture.
By the numbers
- 49.2% of environments with detected model identifiers reference a model scoring 750 or higher, classified as critical.
- 74.5% of the 1,693 analyzed environments reference at least one model scoring 500 or higher, considered high risk.
- 96.6% of environments with both agent indicators and MCP server-building code reference high-scoring models, compared to 49.1% of those without.
What the figures mean
Snyk’s analysis tests models against 29 attacker goals, such as personal data extraction and command execution, assigning scores from 0 to 1,000. A score of 500 or above indicates high risk, while 750 or above is critical. These scores are generated behind basic guardrails, representing the risk of a defended model rather than an undefended one. The data shows that PII extraction and command execution are primary drivers of critical-band findings. However, the presence of a high-scoring model in code does not confirm it is active in production or that an attack has succeeded.
The distinction between model risk and application reach is vital. A model used for summarizing meeting notes poses different operational risks than one querying customer records or triggering workflows. While the model’s adversarial test scores may remain constant, the consequences of failure vary drastically based on what the application can access. Only 37.5% of detected model occurrences have matched risk scores, leaving many references as unknowns that require further review.
What should you do?
Security teams should prioritize investigation over panic, focusing on verifying whether high-scoring models are active in production. It is essential to map out what data, tools, and actions each application can reach, as this context determines the actual impact of a potential failure. Organizations should also assess whether their current guardrails are sufficient for the specific attacker goals identified in the testing, such as data leakage or unauthorized command execution.
Operational impact
Managed service providers should initiate a comprehensive review of their clients' AI inventories, focusing on the integration points between models and external tools. Teams usually need to verify which models are actively deployed versus those merely referenced in code.
It is critical to determine what data sources and business workflows each model can access, as this defines the potential blast radius of a security failure. Security leaders should communicate these findings to development and operations teams to ensure that access controls are aligned with the model's capabilities. Regular audits of model permissions and tool integrations are necessary to maintain a secure posture.
Background: Personal data
Personal data includes any information that identifies you or can be linked back to you. Common examples are names, email addresses, home locations, and IP addresses. Even browser cookies and device IDs count if they can single you out from the crowd.
Read the full guide: Personal Data Examples: What Counts and How to Protect It
What to do and how to stay safe: Snyk
- Audit your AI model inventory to identify which models are active in production and what data or tools they can access.
- Review the specific attacker goals, such as PII extraction or command execution, that resulted in high or critical scores for your models.
- Verify that guardrails are appropriately configured for the context of each application, considering the potential impact of unauthorized actions.
- Monitor environments with agent indicators and MCP server-building code, as these show higher correlations with high-scoring model references.
Step-by-step guide: Shadow AI Explained: 8 Questions Answered for Secure Operations
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What does a critical risk score mean for an AI model?
A critical score of 750 or higher indicates that the model successfully met attacker goals, such as extracting personal data or executing commands, during testing behind basic guardrails.
Are all high-scoring models actively vulnerable in production?
No, the research matches model identifiers in code to test results but does not establish that every model is active in production or that an attack has succeeded.
How does the use of agents affect model risk?
Environments with both agent indicators and MCP server-building code reference high-scoring models at a rate of 96.6%, compared to 49.1% for those without such signals.
