Seven out of every ten MCP servers were already broken

Start with one number: 268,000. That's how many AI tools a single startup crawled in two months. Those tools were sitting on 25,000 Model Context Protocol servers. The scanner spat out more than 143,000 vulnerabilities. Measured by server, 73 percent of them turned up something — roughly seven out of every ten.

The company that produced those numbers is Enkrypt AI. And on August 4, 2026, Anaconda — yes, the Python data science distribution company — announced it had acquired them. Terms were not disclosed.

Pause on how odd that pairing is. Anaconda is not a security vendor. It's the company behind conda install, the thing data scientists put on a fresh laptop before anything else. By its own numbers, 52 million-plus users, 21 billion downloads, and 95 percent of the Fortune 500. Nothing in that history says "vulnerability scanners and runtime guardrails." And yet here they are, buying a red-teaming shop.

Here's the deal, in Anaconda's own words from the announcement post: "Every model an agent runs on, every tool it calls, and every MCP server it touches introduces a potential attack vector." And then the colder line right after it — "you cannot just patch your way out of AI risk."

The timing isn't coincidental either. Two days before the announcement, on August 2, a big chunk of the EU AI Act actually switched on. We'll get to that, and to the important caveat almost everyone gets wrong about it. First, the cast.

A Python packaging company and two Yale PhDs

Anaconda started over a decade ago in Austin, Texas as Continuum Analytics, and became the de facto distribution path for the Python scientific computing stack. Its original business was unglamorous and enormously useful: take NumPy, pandas, scikit-learn and hundreds of other packages, ship them as pre-compiled binaries, and absorb dependency hell on the user's behalf. For most of its life, the company's identity was "the trusted package repository."

That identity changed fast starting in late 2025. On July 30, 2025 the company raised over $150 million in a Series C led by Insight Partners with participation from Mubadala Capital. Bloomberg reported the round valued Anaconda at $1.5 billion — a figure the company hasn't officially confirmed, so treat it as an order of magnitude rather than a fact. Then on October 16, 2025, the board named David DeSanto as CEO. DeSanto came straight from GitLab, where he was Chief Product Officer running the global product organization behind an AI-native DevSecOps platform. Hiring a DevSecOps product leader told you where this company was headed a full nine months before this week's news.

What followed was a sprint. On April 29, 2026, Anaconda acquired Outerbounds, the company behind Metaflow — the open source ML orchestration framework that came out of Netflix and is used by organizations including Realtor.com, GE HealthCare, and Warner Brothers. That moved Anaconda from "package repository" into "production orchestration."

Two and a half months later, on July 15, 2026, it acquired Kilo Code, an open source, model-agnostic coding agent running across VS Code, JetBrains, the web, and the CLI. Anaconda's release put it at more than three million developers and trillions of tokens per month. Worth noting who was on the cap table: Kilo Code's co-founders are Scott Breitenother and Sid Sijbrandij, the latter being GitLab's co-founder and executive chair. Sijbrandij's line at the time is the cleanest summary of Anaconda's whole M&A logic: "Kilo and Anaconda are a rare fit: almost no overlap, and what each of us lacks, the other already has."

And then Enkrypt AI on August 4. Counting from April 29, that's three acquisitions in 97 days. Data preparation (the legacy packaging business) → orchestration (Outerbounds) → agent execution (Kilo Code) → security and governance (Enkrypt AI). Anaconda calls the result a single platform spanning the entire AI-native development lifecycle. Less charitably: they are buying the pieces one at a time and welding them together.

Now the company that got bought. Enkrypt AI was founded in 2022 in Boston by two Yale PhDs — CEO Sahil Agarwal and CTO Prashanth Harshangi, who met during their doctoral program. In February 2024 they raised a $2.35 million seed led by Boldcap, with Berkeley SkyDeck, Kubera VC, Arka VC, Veredas Partners, Builders Fund, and angel investors joining. Forbes headlined that round as a company taking on "the chatbots going rogue."

That framing is the most telling thing in this entire story. In early 2024, "AI security" meant a chatbot swearing at a customer or hallucinating a refund policy. By 2026 it means an autonomous agent calling an unvetted third-party tool that quietly exfiltrates your data. The company didn't grow into a new market so much as the problem grew around it.

A company that raised $2.35 million in seed capital getting acquired four years later by a business embedded in 95 percent of the Fortune 500 tells you how fast this category is consolidating. But note what we don't know: the price. Without it, you can't benchmark this deal against the others in the space, and there have been several.

Scan it, block it, log it — the three-layer stack

Strip the marketing off Enkrypt AI's product and there are three layers.

Layer one is pre-deployment red-teaming. Before a model or agent reaches production, the platform hammers it across more than 300 attack categories — jailbreak prompts, data-exfiltration coaxing, policy bypasses, harmful content generation — automatically, and reports where it broke. The company says it has run this red-teaming research against models from today's leading frontier AI providers, not just customer-built systems.

Layer two is runtime guardrails. No amount of pre-deployment testing predicts everything real traffic will do, so the guardrails block jailbreaks and sensitive-data leakage in real time while the system is live. Anaconda leans hard on one specific detail here: the guardrails deploy inside the customer's own environment rather than routing prompts and responses out to a vendor cloud. For financial services, healthcare, and government buyers who legally cannot ship payloads to a third party, that isn't a nice-to-have — it's the entire go/no-go criterion.

Layer three, and the real reason this deal happened, is MCP governance. It breaks into four parts. The MCP Scanner inspects servers before adoption and returns findings with severity, proof-of-concept, and remediation guidance. The Secure MCP Gateway sits at the boundary and blocks, modifies, or approves individual tool calls at runtime — and the open source version of it is MIT licensed and self-hostable. The MCP Registry maintains a central catalog of trusted servers with owners, risk scores, and metadata. And project-level allowlists enforce least privilege per environment and per agent. On top of all of it sits audit-ready export in PDF, CSV, and JSON. Enkrypt organizes the threat model into six MCP attack vectors: injection, privilege escalation, data exfiltration, response smuggling, shadow adoption, and environment drift.

Of those six, watch "shadow adoption." The other five are technical vulnerabilities. Shadow adoption is an organizational one, and it's the one that actually explains why enterprises are buying. It takes a developer about thirty seconds to find a convenient-looking MCP server on GitHub and wire it into their agent. No approval workflow, no asset inventory, no logging. The security team doesn't know it exists. Anaconda's blog describes a customer anecdote that lands exactly on this: standardized workflows let a team finish work "in under two months," but they could not "confidently say what they had worked on was secure and safe." Velocity gained, visibility lost.

How concrete is Enkrypt's read on this problem? On October 9, 2025 the company published its own study of 1,000 MCP servers, analyzed across four layers — configuration review, code security scanning, tool-level assessment, and network security evaluation. Thirty-two percent had at least one critical flaw, and the average server carried 5.2 vulnerabilities. By type: authorization bypass in 41 percent of servers, prompt injection potential in 35 percent, command injection in 28 percent, network security issues in 23 percent, path traversal in 19 percent, resource exhaustion in 15 percent.

Two named examples from that study are worth remembering. kubernetes-mcp-server carried 26 total vulnerabilities including 13 critical command injections, largely via unsanitized kubectl execution. And postmark-mcp-server was a backdoored server that, by Enkrypt's account, functioned perfectly normally while silently exfiltrating every email it processed. That second one matters more than the first, because it breaks the intuition most teams rely on. "It works fine" and "it is safe" are unrelated statements.

Item Detail Source
Announcement August 4, 2026, terms undisclosed Anaconda
Acquirer Anaconda (CEO David DeSanto, formerly GitLab CPO) Anaconda
Target Enkrypt AI (founded 2022, Boston; Yale PhDs Sahil Agarwal & Prashanth Harshangi) Forbes, Anaconda
Enkrypt seed $2.35M, February 2024, led by Boldcap Forbes
Large-scale scan 2 months, 25,000 MCP servers, 268,000 tools → 143,000+ vulnerabilities, 73% of servers affected Anaconda
Earlier study (2025-10-09) 32% of 1,000 servers had a critical flaw; 5.2 vulnerabilities per server on average Enkrypt AI blog
Red-teaming scope 300+ attack categories, pre-deployment Anaconda
Runtime guardrails Real-time jailbreak and sensitive-data blocking, deployed in customer environment Anaconda
Compliance NIST AI Risk Management Framework, EU AI Act automation Anaconda
Anaconda scale 52M+ users, 21B downloads, 95% of Fortune 500 Anaconda
Anaconda Series C $150M+, July 30, 2025, led by Insight Partners ($1.5B valuation per Bloomberg) Business Wire, Bloomberg
Prior acquisitions Outerbounds (2026-04-29, Metaflow), Kilo Code (2026-07-15, 3M+ developers) Anaconda

The row to read most skeptically is the large-scale scan. That 143,000 figure comes from Enkrypt AI's own scanner, using Enkrypt AI's own severity criteria, and has not been independently verified. We don't know how strictly the tool classifies a "vulnerability," or what share of those findings are practically exploitable versus theoretically flawed. When an acquiring company uses the target's scan output as launch collateral, that filter belongs on it.

None of which means the underlying problem is invented. Real CVEs already exist in this ecosystem — the remote code execution flaw in Anthropic's MCP Inspector (CVE-2025-49596, CVSS 9.4) being the most widely cited. The direction of the finding is almost certainly right even if the precise magnitude is a vendor number.

Who actually walks away with what

What Anaconda gets is a sentence its salespeople can say in a boardroom. DeSanto's quote in the release is unusually blunt about it: "Enkrypt AI makes the unknown known, giving teams the security and guardrails required to get the board, CISO, and legal sign-off they need to scale systems with confidence."

Translate that. Anaconda has historically sold to developers and data teams. But enterprise AI platform contracts don't get signed out of a developer budget. They need the CISO and legal to sign, and those people need an answer to "can you show me what your agents are actually doing." Security here is not a feature — it's a procurement unlock. Deal sizes go up, the buying persona changes, renewal cycles lengthen.

What Enkrypt AI gets is distribution. A company that raised $2.35 million in seed money spends years grinding into Fortune 500 accounts on its own. Anaconda is already inside 475 of them. That turns "months to get a pilot started" into "days." Agarwal's quote makes the strategic fit explicit: "Trust can't be added after an agent ships, it has to be built into and run on a trusted foundation from day one." He's arguing the security layer belongs where the packages and the agents already live.

What enterprise customers get is fewer contracts. Look at how an AI stack is actually assembled today: a package repository, an orchestrator, a coding agent, an LLM gateway, a prompt-injection defense, a model evaluation tool, an audit log. Seven vendors, seven procurement cycles, seven security reviews, seven renewals. Anaconda's pitch is that those seven lines become one. If it works, the savings aren't in license fees — they're in the time of the procurement and security-review teams, which is the more expensive resource in most large organizations.

But somebody loses too. If you're an existing Enkrypt customer running a different platform stack, an option just disappeared. As an independent vendor, Enkrypt could bolt onto anything. As Anaconda's security layer, its roadmap priorities will inevitably tilt toward Anaconda customers. The company says current users' products, plans, and support remain unchanged with integration details to follow — which is the standard sentence in every acquisition announcement, not a long-term guarantee. The MIT-licensed open source gateway is the one genuine escape hatch here, and whether that open core keeps getting maintained is the thing to watch.

And then there's the open source community's memory. In March 2024, Anaconda updated its terms of service so that any organization with 200 or more employees or contractors — for-profit companies, but also government agencies and non-profits — needed a paid license to use its repositories. The backlash was substantial. Anaconda itself later acknowledged in a blog post that the change was not communicated clearly, causing "confusion, concern, and unintentional exclusion of a large number of free users," particularly in academia and research. Some institutions, including Lawrence Livermore National Laboratory, moved to phase out Anaconda support entirely. So: a company with a track record of making a formerly free thing paid is now the one shipping your security layer. That history is exactly why community reaction to this deal is cooler than the press release suggests.

This movie has already run four times

The AI security market has been playing the same scene on repeat for fifteen months. Laid out in order, the pattern is hard to miss.

Palo Alto Networks and Protect AI. Announced April 28, 2025, completed July 22, 2025. Palo Alto absorbed model scanning, posture management, AI red teaming, runtime protection, and AI agent security into a product family called Prisma AIRS. This is the orthodox path: a security company buys an AI security startup and staples it onto an existing security portfolio. It counts as a success mostly because Palo Alto kept executing the same logic afterward — it completed the Chronosphere acquisition (observability) on January 29, 2026 and CyberArk (identity) on February 11, 2026. Telemetry, identity, and AI security sold out of one wallet is a coherent thesis, and they're building toward it deliberately.

Check Point and Lakera. Announced September 16, 2025. Lakera was a Zurich and San Francisco company specializing in agentic AI application security. The price was not officially disclosed, though Israeli outlets reported roughly $300 million.

SentinelOne and Prompt Security. Announced August 5, 2025 at approximately $250 million. But when the transaction closed on September 5, 2025, the actual consideration came in at roughly $180 million in cash and stock. That gap between announced and closed value is the single most instructive data point in this entire section. Equity-linked consideration moving with the acquirer's stock explains the mechanics, but the takeaway stands: the assumption that any AI security startup automatically commands a premium has cracks in it.

Snyk and Invariant Labs. June 24, 2025 — and this is the one that most closely rhymes with Anaconda/Enkrypt. Invariant Labs was an ETH Zurich spin-off less than a year old. It built MCP-Scan, targeting MCP-specific threats like tool poisoning and "MCP rug pulls," plus Guardrails, a policy engine for enforcing contextual rules on agent behavior. Snyk folded it into its AI Trust Platform. The structure is identical to what Anaconda just did: a developer tooling company buys an MCP security research team and makes it the security layer of its own platform.

Now the failure mode, because there is one and it's predictable. Acquisitions in this category rarely fail because the technology was bad. They fail because the product gets absorbed into a platform and its independent improvement rate dies. A security scanner's entire value is how fast its detection rules keep up with attackers. When post-acquisition engineering capacity gets consumed by integration work — SSO, billing, data model reconciliation, UI consolidation — rule updates slow down while attack techniques keep evolving. That's the same pattern that has hollowed out acquired products in the observability and APM markets on a two-to-three-year lag. Anaconda saying "integration details will follow" is procedurally normal, but six months from now the honest scorecard for this deal is simply: how often are the scanner's detection rules shipping?

There's also a condition the successful deals share. The acquirer has to already be positioned to see the relevant data. Palo Alto sees network traffic. Snyk sees code repositories. Anaconda? It sees package installation paths, and now — via Kilo Code — agent execution paths too. That combination is genuinely not bad. Knowing that an MCP server is vulnerable is one capability; knowing which of your agents actually has it wired in is a different and rarer one. Anaconda sits in one of the few places where both are visible.

Palo Alto, Check Point, and Anthropic all get a move

Counter-play one: the incumbent security vendors. Palo Alto, Check Point, SentinelOne, and Snyk have all bought their AI security assets already, and their argument is simple — AI security isn't a separate category, it's a function of security, and the security team already lives in our console. That's powerful because it puts the purchase in the CISO's budget. Anaconda's path enters through the developer organization instead. When those two motions collide inside a large enterprise, the bigger budget usually wins. Anaconda's rebuttal is that it sees the system from the moment code is written, so it can prevent rather than detect after the fact. That argument hasn't been settled.

Counter-play two: hyperscalers and model providers. AWS, Google, and Microsoft already bundle guardrails and model evaluation tooling, and Anthropic — which created MCP — controls both the protocol and the official registry. There's an interesting tension here. When security researchers flagged command execution behavior in the official MCP SDKs, Anthropic reportedly treated it as intentional design rather than a protocol-level vulnerability, framing input sanitization as a developer responsibility. When the protocol designer draws that line, the gap it leaves behind is precisely the market Enkrypt sells into. Flip it around, though: if Anthropic strengthens registry-level signing, verification, and reputation, the value of a third-party scanner shrinks considerably. Which way that goes determines the size of this entire category.

Counter-play three: open source and free alternatives. Invariant Labs' MCP-Scan is well known post-acquisition, and Enkrypt itself released the open source version of its gateway under MIT. The basic MCP scanning functions — inspecting tool descriptions, checking permission scopes, matching known vulnerable patterns — are substantially implementable in open source. Which means the commercial product doesn't actually sell on scanning. It sells on turning scan output into audit evidence. That's exactly why Enkrypt leads with audit-ready PDF/CSV/JSON exports and compliance framework mappings rather than detection counts.

Counter-play four: regulation itself. From August 2, the EU AI Act's transparency obligations under Article 50, enforcement powers over general-purpose AI, and the full penalty regime became applicable. But here's the part almost every vendor pitch glosses over: on June 16, 2026, the European Parliament gave final approval to the Digital Omnibus amendments by 423 votes to 57 with 174 abstentions, pushing high-risk AI obligations out by 12 to 16 months. Stand-alone Annex III high-risk systems — recruitment, credit scoring, law enforcement, education, border control — now have until December 2, 2027. AI embedded in Annex I regulated products like medical devices, machinery, and vehicles has until August 2, 2028. So "high-risk regulation kicked in on August 2" is simply wrong. What kicked in was transparency plus the penalty and enforcement machinery.

That distinction cuts both ways for anyone selling compliance automation. Delaying high-risk obligations removes near-term urgency — the panic-buy reason moved eighteen months out. But activating enforcement powers and penalties means there's now a live basis for a regulator to act on something. Two forces pulling in opposite directions, and which one dominates won't be knowable until actual enforcement cases land. Anaconda name-checking the EU AI Act in its announcement is a rational sales move; just know the regulatory clock it points at got substantially rewound six weeks earlier.

Counter-play five: the MCP ecosystem cleaning up after itself. Public MCP server counts were tallied above 10,000 as of December 2025, and an independent pull of the official MCP Registry API on May 24, 2026 counted 9,652 latest server records and 28,959 server/version records. (Both are community tallies, not official figures.) An ecosystem growing at that rate tends to end up walking the road npm and PyPI walked — signing, provenance, trust tiers, automated auditing. If that infrastructure becomes standard at the protocol layer, standalone scanners get squeezed into a narrower role. The counterpoint: it took npm well over a decade to get there, and MCP is roughly two years old.

So what actually changes

For developers and platform engineers, three concrete things landed on your plate. First, actually build the inventory of MCP servers running in your organization. Most teams don't have one. Just collecting what's in everyone's mcp.json and agent config files tends to produce surprises. Second, count how many of those came from outside, and find out whether anyone read the code. The postmark-mcp-server case is the argument: functioning correctly and being safe are unrelated properties, and a well-behaved backdoor is indistinguishable from a well-behaved tool without inspection. Third, check whether tool-call logs exist at all. When something goes wrong, you need to reconstruct what the agent invoked — and most organizations still can't.

For enterprise decision-makers, the signal in this deal is that AI security is having trouble surviving as a standalone category. In fifteen months, Protect AI, Lakera, Prompt Security, Invariant Labs, and now Enkrypt AI have all been absorbed into larger platforms. If you're about to sign with a point solution, price in a meaningfully high probability that it won't be independent in two years. Read the assignment and data-portability clauses before you sign. Conversely, when a platform vendor says "we do all of it," account for the fact that the layers have wildly different maturity. Anaconda's packaging business is over a decade old. Its security layer is four days old.

For investors, two things read clearly. One is that the exit path in this category is overwhelmingly M&A. Seed at $2.35 million, strategic acquisition four years later — that's not an unusual outcome here, it's close to the standard one. The other is that valuations aren't climbing the way the theme's heat would suggest. Lakera at a reported ~$300 million, Prompt Security announced at $250 million and closing at roughly $180 million. For a category this hyped, those are modest absolute numbers. The likely reason is that the technical moat is thin and a large incumbent can build a passable version in six to twelve months. Which makes these acquisitions primarily purchases of a team and of time, not of defensible technology. Anaconda declining to disclose the price fits that reading comfortably.

For security and compliance leads, there's a related item from this week's discourse. A study that circulated on Hacker News (228 points, 179 comments) found that humans approving AI agent commands missed one in three risky actions across 40,000 simulated runs. The most-quoted comment: "Human-in-the-loop was never a safety guarantee, it's a liability shield." That's the strongest available argument for why products like Enkrypt's exist. The premise that a person reviews every tool call has already collapsed in practice, and if clicking approve can't filter risk at the rate agents generate it, an automated policy layer is the only remaining option. The uncomfortable recursion is that the accuracy of that automated layer is itself unverified — you've replaced a human you can't trust to catch everything with a classifier you also can't fully audit.

For regular users, nothing visible changes. But there's an indirect thread worth pulling. If a service you use has AI agents doing real work behind the scenes — pulling up account details, modifying orders, sending documents — then whether that company governs which tools its agents connect to eventually maps onto whether your data stays put. Remember what the postmark-mcp-server backdoor was quietly siphoning: not the deploying company's internal data, but its customers' email. The blast radius of an unvetted agent tool doesn't stop at the company that installed it.

Compress the whole story into one line and it's this. In 2024, AI security meant "what if the chatbot says something offensive." In 2026, it means "an agent called a tool on an unvetted server and I can't tell you what it deleted." The nature of the problem moved from content to execution privileges — and that's exactly why the buyers moved too, from content-filtering companies to development platform companies.

🥄 Three Things You're Probably Wondering

— So what does this mean for me? Directly, not much. But if your company runs coding agents or MCP servers, the first question worth asking is whether anyone has an inventory of them. Enkrypt's study found roughly one in three servers carrying a critical flaw, and most teams don't even know what they've plugged in.

— Why is this happening now? Through 2025, MCP was mostly something developers experimented with on personal laptops. In 2026 it moved into corporate production, which changes everything. Public MCP servers passed 10,000, and two days before the deal, on August 2, the EU AI Act's transparency obligations and penalty regime started applying. That said, high-risk obligations got pushed to 2027–2028 by the Digital Omnibus amendments, so it's a stretch to say regulation forced this acquisition.

— Is Anaconda ahead of Palo Alto or Check Point now? No, and it's not really the same game. Palo Alto already absorbed Protect AI into Prisma AIRS and added Chronosphere and CyberArk on top; the scale gap isn't close. Anaconda's one real differentiator is the entry point — it comes up through the development environment rather than the security console. Already owning the place where code gets written and packages get installed could turn into a genuine edge. Whether it converts into revenue is impossible to judge when even the purchase price hasn't been disclosed, so it's too early to call.

Sources

Numbers and criteria are as of announcement and may change. Investment calls are yours to make!