A first look at 10,000 workstations
We analyzed AI agent activity across 10,000 workstations at Upwind customers in the United States and Europe. This post is a sneak peek at the findings ahead of the full report.
The short version: agent adoption has already moved past the point where an approval process can catch up with it, and almost none of it is supervised. The risk that follows is not confined to the laptop. It lands in your cloud and your SaaS tenants.
Mistakes, Not Malice
79% of employees in organizations of 1,000 to 3,000 people use an AI agent in their daily workflow. Adoption is not confined to engineering. Finance, marketing, and sales run agents every day.
Someone in finance can hand an agent a goal and let it write and execute the Python required to reach that goal. The work gets done. The code is never read.
That changes the shape of the incidents we see. An agent granted a scope wider than the task. A credential reused across three tools. A file posted to a destination nobody checked. Almost everything we found traces back to an error rather than to intent.
Controls built to catch an attacker will miss most of this. What catches it is scope and destination.
Builders Are the Larger Attack Surface
The working assumption has been that developers carry the most endpoint risk. Our data no longer supports that.
Claude Cowork reaches 73.5% of scanned workstations, ahead of Claude Code at 57.8%. Anthropic leads the workforce category, and the category itself is the finding. Cowork-class tools are used by people who build with agents without writing code.
Those people hold the business access. Salesforce. Snowflake. The shared drive. An agent on their machine inherits all of it the moment it is installed, and data leaving through that path is now more common than data leaving through a developer’s.
Exposure follows access. Access follows the SaaS estate, and the SaaS estate is where the business data sits.
Where the Agents Come From
89.9% of scanned workstations run agents of US origin only: Claude, GitHub Copilot, Codex, and others in that set. 9.2% run at least one non-US agent, including Pi and Junie CLI. Chinese agents, mainly Kimi Code and Qwen Code, appear on 1.97% of scanned workstations. 0.9% run no agent at all.
The non-US share is small. It is also unmanaged, and it operates inside the same credential scope as everything else on the machine. If you carry data residency or export obligations, agent origin is now an inventory question with an owner and a review date.
From Three Agents to Ten
Adoption is not evenly distributed. 39% of employees run three or more different agents. 2.07% of workstations run ten or more.
Density crosses department lines. Heavy users turn up in engineering, in sales, in marketing, and in support.
Each agent arrives with its own skills, its own MCP servers, and its own update channel. Ten agents on one laptop is ten independent supply chains sharing a single identity.
This is why Upwind AI Labs recommends a different threat model for the endpoint, one that does not inherit its boundaries from the org chart. The org chart is the wrong security boundary.
MCP: Zero, or Fifty
Model Context Protocol (MCP) adoption splits hard. 61.9% of scanned machines have no MCP server wired at all. 14% wire into 50 or more.
Among machines with at least one MCP server, these are the most common:
Read the right-hand column. Roughly a quarter of all scanned machines connect an agent to Notion, to Atlassian, to Slack, to Drive, to Gmail. That is the roadmap, the ticket queue, the customer threads, the documents, and the telemetry.
An agent holding those connections has read access across most of a company’s working memory. It was granted by one person, in one click, with no review step in between.
Thirty Percent Shared, Seventy Percent Unique
Skills are where the picture gets harder to govern. A repetitive task becomes a skill, the skill improves the agent’s output, and the skill persists.
30% of the skills we found came from a known repository and appeared on more than one machine. 70% are unique to a single user on a single machine: written by hand, assembled from pieces, or generated by a local process.
A blocklist handles the 30%. The remaining 70% has no publisher, no reputation signal, and no second observation to compare against. It is a supply chain with one consumer and no maintainer.
The Boundary Moved
Every number above describes a cloud and SaaS problem that begins on a laptop.
An agent acts with the credentials of the person who installed it. An unreviewed skill, an uninventoried MCP server, and an unchecked destination all operate inside that person’s existing access. The endpoint is where the action starts. The consequence lands in your cloud accounts, your data warehouse, and your SaaS tenants.
That is why severity cannot be decided at the endpoint. An agent that reads a file and posts the contents to an IP address produces an identical event whether the destination is a sandbox or a production data lake. Telling those apart requires live cloud and SaaS runtime context, applied at the moment the action happens.
What the AI Sensor Covers
Upwind announced the AI Sensor for Endpoints last summer. It runs on Windows, macOS, and Linux, and it extends Upwind Runtime Intelligence to the machines where agents actually execute.
- Visibility. A full AI-Bill-of-Materials (AI BOM) covering every agent, MCP server, skill, and extension across endpoints and cloud, with its source, its privileges, and its activity. One inventory, maintained continuously.
- Exposure. Continuous analysis that surfaces sensitive data in use by agents, privilege abuse, malicious skills and MCP servers, and risky configuration. Results break down by cost center and machine designation, so ownership is clear before the conversation starts.
- Threats. Real-time detection of supply-chain attacks, data leakage, and agent misuse, with the source traced and the response available in the same place.
Severity is arbitrated against live endpoint, cloud, and SaaS exposure. The alert you see is the one where the blast radius is real.
Deploying at Scale
No reboots. No kernel extensions. No new rollout process.
The sensor deploys in minutes through the MDM you already run, including Jamf, Intune, Kandji, JumpCloud, and Mosyle. It authenticates to your tenant automatically and reports to your dashboard immediately. Different scan profiles for finance and engineering are configured remotely, with no redeployment.
See It on Your Own Environment
Agent adoption at the endpoint is a cloud exposure problem, and it is already at scale in most organizations we scan. The teams getting ahead of it are the ones treating agents, skills, and MCP servers as inventory with owners and review cycles.
The full report will be published soon. Follow Upwind on LinkedIn to get it on release, or book a demo and see what the AI Sensor surfaces on your own machines in 15 minutes.