14 Oct 2026 · Margot Reyes (editorial persona) · Original research and datasets · on threat.cafe

Why agent-security statistics disagree: a source-lineage audit of the MCP and skills numbers vendors quote

Agent-security statistics disagree because they count different things. "43% of MCP servers" comes from an undisclosed number of popular servers tested in March 2025. "82%" measures which file APIs code uses, not confirmed flaws. "5.5%" is from a preprint covering 1,899 open-source servers. "24,008" is a count of secrets with no denominator on the page. "25% of breaches by 2028" is a forecast. Two numbers in circulation, a "72.4% cascade rate" and "14.4% of agents reach production with full security approval," have no source we could trace. Of the ten figures audited here, seven are citable only with their population and definition stated, one only as a forecast, and two should not appear in a business case at all.

The headline metric that changes the question

The question a board slide invites is "how vulnerable are MCP servers?" The register below shows why that question has no single answer. Each study chose a different population, a different unit and a different definition of "vulnerable." The useful question is narrower: for this number, what was counted, out of how many, by whom, and when?

Why the roundups mislead

Most leaders meet these numbers in aggregator posts. The one audited here, a statistics roundup published by the training company Practical DevSecOps on 26 June 2026, is a useful index of what is circulating (Practical DevSecOps). It names a source for most figures. It links none of them, which means a reader cannot check any figure from the page itself. It also mixes vendor scans, academic counts, survey results and analyst forecasts in one list, and several figures carry no source at all.

That is not a charge against one publisher. It is the normal state of a fast field. The fix is to trace each number back before it goes into a budget request.

Method

For each figure, the origin was located and read on 15 October 2026. Each row records what the origin actually measured, the denominator, the date, who produced it, and a verdict:

Cite: usable with the population stated.
Cite as forecast: usable only labelled as a prediction.
Do not cite: origin not found, or the claim as circulated misstates the origin.

The register

#   Figure as circulated              What the origin measured                         n / unit                 Origin, date                  Verdict
--  --------------------------------  -----------------------------------------------  -----------------------  ----------------------------  -----------------
1   43% command injection             "43% of tested implementations contained         Not stated; "some of     Equixly (vendor), 29 Mar      Cite with caveat
                                      command injection flaws"                         the most popular"        2025
2   82% path traversal                "82% use file system operations prone to         2,614 implementations    Endor Labs (vendor),          Cite as API usage,
                                      Path Traversal (CWE-22)"                                                  report 2025, blog Jan 2026    not as flaws
3   5.5% tool poisoning               Share of servers showing MCP-specific tool       1,899 open-source        Hasan et al., arXiv preprint  Cite, label
                                      poisoning                                        servers                  2506.13538, v5 Apr 2026       preprint
4   24,008 secrets                    "unique secrets exposed in MCP configuration     Count; denominator not   GitGuardian (vendor), State   Cite as a count
                                      files"                                           on page                  of Secrets Sprawl 2026
5   36.82% of skills flawed           Skills with at least one finding of any          3,984 skills, ClawHub    Snyk (vendor), 5 Feb 2026     Prefer 13.4% and
                                      severity                                         and skills.sh                                          76 (see text)
6   87.8% never audited               Listings with no audit verdict                   79,848 skills.sh         Skillselion (directory),      Cite
                                                                                       listings                 data 12 Aug 2026
7   12.7% auditor conflict            HIGH/CRITICAL vs LOW/SAFE on the same listing    1,233 multi-rated        Skillselion, 12 Aug 2026      Cite
                                                                                       listings
8   25% of breaches by 2028           "25% of enterprise breaches will be traced       Prediction               Gartner, 22 Oct 2024          Cite as forecast
                                      back to AI agent abuse"
9   72.4% cascade rate                No source given                                  Unknown                  None found                    Do not cite
10  14.4% reach production with       No source given                                  Unknown                  None found                    Do not cite
    full security approval

Data sliced by the dimension that matters

Population. Equixly tested "some of the most popular MCP server implementations over the past month," with no count and no selection rule (Equixly, 29 March 2025). Hasan and colleagues evaluated 1,899 open-source servers (arXiv 2506.13538). Popular servers and the long tail are different populations. A rate from one does not transfer to the other.

Unit. Endor Labs counts implementations whose code uses risky APIs (Endor Labs, 23 January 2026). GitGuardian counts secrets in config files (GitGuardian). Snyk and Skillselion count skills or listings. A server, a code path, a secret and a listing are four different denominators.

Definition. Endor's own wording is that 82% "use file system operations prone to Path Traversal." That describes exposure to a bug class, not a confirmed flaw. The aggregator headline calls it "vulnerable." Snyk's 36.82% counts "at least one security flaw" at any severity, including categories Snyk itself calls "benign by design" in many cases (Snyk, 5 February 2026). The same study reports 13.4% (534 skills) with at least one critical issue, and 76 malicious payloads confirmed by human review. For a board, 76 confirmed malicious skills out of 3,984 is the harder and more defensible number.

Date. Equixly's 43% is from March 2025. The aggregator presents it under a 2025 to February 2026 range. MCP has changed a great deal since then.

Competing explanations for the spread

Why do vulnerability rates for "MCP servers" run from about 5% to over 80%? Four mechanisms account for most of it, and none requires anyone to be wrong:

Detection method. Hands-on offensive testing finds more per server than static pattern matching across thousands.
Threshold. "Uses a risky API" is a much lower bar than "contains an exploitable flaw."
Selection bias. Popular servers attract more testers and more features; long-tail servers are smaller and simpler.
Incentive. Most origins are vendors whose products address the problem they measure. That does not make the numbers false. It is a reason to state the sponsor.

Two numbers that collide by coincidence, or not

The aggregator lists "14.4%" of agents reaching production with full security approval, and "66%" of 1,808 servers with a security finding (attributed to an AgentSeal scan, unlinked). The Hasan et al. abstract contains both numbers measuring other things: 66% of servers exhibit code smells, and 14.4% contain ten bug patterns that overlap with prior research. We cannot tell from the pages whether this is coincidence or a mis-attribution. Either way, neither figure is traceable to the claim it is used for, so neither should be cited for that claim.

Methodology, denominators and limits in plain sight

This audit has limits of its own. It covers ten figures from one roundup, not the whole literature. Some origins are summaries of fuller reports; Endor's blog cites its 2025 Dependency Management Report, which was not read here. Snyk points to a full technical report on GitHub that was not read either. Where a page gave no denominator, the register says so rather than inferring one. A later correction by any publisher would change a verdict, and corrections are welcome.

Decision consequences: the safe-to-cite shortlist

For a business case or board slide in late 2026, these hold up when quoted with their population:

76 malicious skills confirmed by human review among 3,984 scanned, ClawHub and skills.sh, Snyk, February 2026.
87.8% of 79,848 skills.sh listings never audited, with auditors disagreeing on 12.7% of the 1,233 listings rated more than once, Skillselion, August 2026.
5.5% of 1,899 open-source MCP servers showed tool poisoning, Hasan et al., arXiv preprint.
24,008 unique secrets found in MCP configuration files, GitGuardian, 2026 report on 2025 data, as a count.
Gartner predicts 25% of enterprise breaches will be traced to AI agent abuse by 2028, labelled as a forecast from October 2024.

Paste this format beside any figure you use:

Figure:     ___  (exact wording from origin)
Population: ___  (n and unit: servers / skills / listings / secrets)
Method:     ___  (pentest / static scan / scanner + human review / survey / forecast)
Producer:   ___  (and whether they sell a related product)
Date:       ___  (data date, not repost date)

What would falsify this register? A publisher releasing the denominator or method behind a figure marked "cite with caveat" would upgrade it. Anyone producing the origin of the 72.4% or 14.4% figures would move them off the do-not-cite list.

When threat.cafe publishes numbers of its own, they come with the same five fields; the threat.cafe board shows the format on real incidents.

Sources

#statistics #mcp #agent-skills #research-methods #business-case

All posts