Anaconda — the company most data teams know as the thing that installs their Python packages — announced Tuesday that it has acquired Enkrypt AI, a startup that red-teams AI models and agents before they ship. Terms were not disclosed.
The acquisition is not the interesting part. The number Enkrypt brought with it is. In the two months leading up to the announcement, the company says it scanned more than 268,000 tools — the individual functions an AI agent is allowed to call — across 25,000 Model Context Protocol servers. It found more than 143,000 vulnerabilities. Seventy-three percent of the servers had at least one.
MCP is the plumbing — the open standard that lets an agent reach out of the chat window and touch a real system: your CRM, your file store, your calendar, your payments dashboard. Every one of those connections is a server somebody stood up fast, usually one team, almost never with a security review attached. Enkrypt’s scan is the first published attempt to measure how much of that layer is load-bearing and unexamined at once.
Consider the source, then consider the number
This is a security vendor publishing a scary statistic about the problem it sells the fix for, on the day it got acquired for building that fix. That deserves the obvious discount. “Vulnerability” is doing heavy lifting — the disclosure doesn’t break the 143,000 into severity tiers, and a permissive scope on a read-only tool is not the same animal as a prompt-injection path to a wire transfer.
Apply the discount and the number is still bad. Even if most findings are low severity, 73% means the base rate of “this server has something wrong with it” is a coin flip that lands heads three times in four. Nobody else has published a competing census, and in the absence of a neutral measurement, the vendor’s is the one the market prices on.
Why a package manager is buying a red team
Anaconda has now bought three companies into the same thesis: Outerbounds for orchestration, Kilo Code for agentic engineering, and now Enkrypt for security and compliance. CEO David DeSanto’s framing is that enterprises are already running AI applications that “contain exploitable vulnerabilities and weaknesses” and cannot easily see them.
Translation: the company that spent a decade curating which open-source packages you were allowed to install has decided the same job now exists one layer up, for models, agents, and MCP servers. Enkrypt brings pre-deployment red-teaming across more than 300 attack categories, runtime guardrails that run inside a customer’s own environment, and compliance automation mapped to the NIST AI Risk Management Framework and the EU AI Act. It is already an OpenAI compliance integration partner; Anaconda says the same model-agnostic support is planned for Anthropic.
Our take: Agent security keeps getting sold as a model problem — can it be jailbroken, will it say something terrible. That framing is comfortable because it puts the risk inside somebody else’s lab. Enkrypt’s scan points somewhere worse: the risk is in the connectors, and the connectors are yours. You wrote them. You deployed them. Nobody audited them, because six months ago they didn’t exist. It is the pattern of every dependency layer that ever mattered — npm, Docker images, CI runners — where adoption outruns scrutiny for exactly one cycle, and the correction shows up as an acquisition spree. That cycle just ended.
What to watch
- Whether anyone contests the census. One vendor number is marketing. A second scan from a neutral party — a CERT, a cloud provider, an academic group — is a finding. Until that lands, treat 73% as directional, not settled.
- Severity disclosure. If Enkrypt publishes the breakdown under Anaconda, the number gets more useful and probably less alarming. If it never publishes one, that tells you something too.
- Who buys next. Anaconda is three acquisitions into a full-stack AI platform, and every hyperscaler and security incumbent is staring at the same gap. Agent-security startups just got repriced.
- Enterprise MCP policy. The tell that this is real: companies publishing internal rules about which MCP servers agents may connect to. Approved-connector lists are the corporate immune response, and they arrive before the tooling does.
The short version: enterprises spent 2026 wiring agents into everything on the theory that the hard safety problem lived inside the model. The scan says it lives in the 268,000 small functions the model is allowed to call — and that almost nobody has looked at them.