Snyk Data Links AI Model Risk Scores to Agent Reach and Tool Access
New research shows that nearly half of enterprise environments reference critical-scoring AI models, but impact depends on system connectivity.
Key points
- % of scanned environments reference a model scoring 750 or higher on Snyk’s adversarial tests.
- Environments with both agent indicators and MCP server code show high-scoring model references in 96.6% of cases.
- Only 37.5% of detected model occurrences have a matched risk score, leaving many references unscored.
Snyk published new findings from its 2026 State of Agentic AI Adoption, Volume III, revealing that nearly half of enterprise environments reference AI models with critical risk scores. The research emphasizes that a model’s inherent vulnerability score is insufficient for security assessment without understanding the system’s reach. Security teams must evaluate what data and tools an application can access.
The analysis scanned thousands of enterprise environments to map model identifiers to adversarial test results. Snyk tests models against 29 attacker goals, such as data extraction or command execution, assigning scores from 0 to 1,000. A score of 750 or higher is classified as critical. The study found that 49.2% of the 1,693 environments with detected model identifiers reference at least one critical-scoring model.
Context and Methodology
Snyk’s methodology combines attack success frequency with potential damage severity to generate each score. The tests are conducted behind basic guardrails, meaning the scores reflect defended models rather than undefended ones. PII extraction and command execution were the primary drivers for critical-band findings in this sample. The firm notes that a high score indicates where triage should begin, not necessarily that an attack has succeeded in production.
Coverage gaps remain a significant factor in these assessments. Only 37.5% of detected model occurrences had a matched risk score. Approximately 17% of environments containing model references had no scored model at all. The research advises treating unscored or versionless references as unknowns that require manual review, rather than assuming safety based on the absence of a score.
Impact of Connectivity
The presence of agents and Model Context Protocol (MCP) servers significantly alters the risk profile. A model connected to workflows and data sources can act on unsafe outputs, expanding its potential impact. Among 1,051 US accounts with an MCP reference, 70.8% showed evidence of building an MCP server using an SDK. The distinction between building, configuring, and operating a server is critical, as only runtime verification confirms actual operation.
Environments with both agent indicators and MCP server-building code referenced high-scoring models in 96.6% of cases. In contrast, environments with no detected agent or MCP signal referenced high-scoring models in only 49.1% of instances. This suggests that the technical architecture surrounding the model determines the severity of the exposure more than the model’s isolated score.
Inventory size influences the total count of findings but not the proportional mix. The likelihood of finding at least one high-scoring model rises from 34.6% in the smallest estates to 100% in the largest. However, the share of model occurrences linked to high scores remains stable between 21% and 25% across all sizes.
What should you do?
Security leaders should use these counts to size their review backlogs and benchmark model choices against peers. However, neither the count nor the share indicates what an active application permits a model to do. The immediate priority is to determine if high-scoring models are active in production, what specific tools they can reach, and what consequences would follow if they fail.
What to do and how to stay safe: Snyk
- Inventory all AI model references in code and check for versionless or unscored entries that require manual review.
- Identify which models are connected to agents, MCP servers, or external data sources to assess their operational reach.
- Prioritize remediation for models that are both high-scoring and connected to sensitive workflows or customer records.
- Verify the runtime status of any MCP servers to distinguish between development configurations and active production environments.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does Snyk calculate the risk score for an AI model?
Snyk tests models against 29 attacker goals, combining the frequency of attack success with the potential damage of that goal on a scale of 0 to 1,000.
What percentage of environments reference a critical-scoring model?
According to the Snyk research, 49.2% of environments with at least one detected model identifier reference a model that scored 750 or higher.
Does a high risk score mean the model is currently being attacked?
No, the research matches identifiers to test results but does not establish that every model is active in production or that an attack has succeeded in the organization.
