In This Article
Key Takeaways
- On August 4, 2026, Anaconda Inc. announced it acquired Enkrypt AI, an AI security and compliance company. Financial terms were not disclosed.
- The release cites Enkrypt scan data: more than 268,000 tools across 25,000 MCP servers in the preceding two months, more than 143,000 vulnerabilities, 73% of servers affected.
- Enkrypt sells three things: pre-deployment red-teaming, runtime guardrails against jailbreaks and data leakage, and a scanner that inventories MCP server configuration, permissions and tool schemas.
- This is Anaconda's third acquisition in roughly three months, after Outerbounds (April 29) and Kilo Code (July). The pattern is a platform being assembled by purchase.
- The vulnerability figures are vendor research published without a methodology. Useful as a signal about where the risk sits. Not a substitute for scanning your own servers.
Anaconda is the company most Python developers know as the thing that installs their packages. On August 4, 2026, it announced it had bought an AI red-teaming company. The press release, datelined Austin, Texas, says Anaconda Inc. acquired Enkrypt AI, described as "the AI security and compliance solution that finds and mitigates risks hidden inside enterprise AI." Financial terms were not disclosed.
Acquisitions with undisclosed terms usually make thin reading. This one is worth stopping on for a different reason: the release publishes a set of scan numbers about Model Context Protocol servers, and those numbers describe the infrastructure a lot of teams shipped this year without auditing.
What was announced
Anaconda says the acquisition puts a security and governance layer over its platform so that, in the release's words, "every model, agent, and MCP server" running under it becomes "one the enterprise can trust." Existing Enkrypt AI products stay available, with what Anaconda calls no immediate changes to existing products, plans, or support.
David DeSanto, CEO of Anaconda, is quoted: "Enterprises are running AI-native applications and services that already contain exploitable vulnerabilities and weaknesses, leaving them exposed to unknown risks they cannot easily address. Enkrypt AI makes the unknown known, giving teams the security and guardrails required to get the board, CISO, and legal sign-off they need to scale systems with confidence."
Sahil Agarwal, co-founder and CEO of Enkrypt AI, is quoted: "There's a difference between running AI, and running AI safely. Enterprises are actively looking for a way to reduce AI model security risk, before it levels up to a boardroom problem. Trust can't be added after an agent ships, it has to be built into and run on a trusted foundation from day one."
Both quotes point at the same buyer persona, and it is not the developer. It is the person who has to sign off before the agent reaches production.
The scan figures in the release
Here is the part worth reading twice. Anaconda's release states that Enkrypt AI scanned more than 268,000 tools across 25,000 MCP servers in the two months before the announcement, and found more than 143,000 vulnerabilities affecting 73% of the servers scanned.
MCP is the protocol that lets a model call software: query a database, read a file, hit an internal API, hand work to another agent. It went from proposal to default plumbing fast, which is the shape of the problem. If you want the background on how it got there, we wrote it up in MCP in 2026: The Standard That Won, and the directory of what people actually run is in 35+ Free MCP Servers Every Dev Should Know.
Enkrypt published a smaller version of this research earlier. Its October 9, 2025 post reported scanning 1,000 MCP servers and finding that roughly a third had at least one critical vulnerability, at an average of 5.2 findings per server, broken down like this:
Enkrypt AI's October 2025 scan of 1,000 MCP servers
| Finding | Share of servers | What it looks like |
|---|---|---|
| Authorization bypass | 41% | No role-based access control, no ownership validation |
| Prompt injection paths | 35% | Tool output that can steer the agent that called it |
| Command injection | 28% | Shell commands assembled from unsanitized input |
| Network security issues | 23% | Missing TLS validation, server-side request forgery |
| Path traversal | 19% | Unsanitized file paths that escape their directory |
| Resource exhaustion | 15% | Unbounded operations that become a denial of service |
Read that table as a map of where the weak joints are, not as a census. It is vendor research from the company being acquired, published without a reproducible methodology, and "vulnerability" is carrying weight it has not earned in public. A hobby server on someone's laptop flagged for missing role-based access control is not the same finding as an injectable shell call in a tool your finance team uses. The percentages tell you which classes of defect are common. They cannot tell you your exposure.
What Enkrypt AI actually sells
Three products, described plainly.
- Pre-deployment red-teaming. Anaconda describes it as testing "across more than 300 attack categories so failures surface in testing rather than in front of a user." This is the adversarial-eval slot: you run attacks against your own system before someone else does.
- Runtime guardrails. Anaconda says these block "jailbreaks and sensitive-data leakage in real time," deployable inside a customer's own environment. That last clause matters for anyone who cannot send prompts to a third-party inspection service.
- MCP Scanner. Enkrypt's product page groups its checks into four risk classes: injection risk, sensitive-data risk, response-integrity risk (tool outputs that "smuggle instructions into the agent loop"), and policy risk. It inventories server configuration, permissions, tool schemas and endpoints, and returns findings with severity and reproduction notes.
On top of that sits compliance mapping. Anaconda's writeup says the platform turns the NIST AI Risk Management Framework and the EU AI Act "into enforceable guardrails." Treat that phrase the way you would treat any vendor's control-mapping claim: ask which specific subcategories are covered, what evidence the tool produces, and who signs the assertion. Our guide to evaluating an AI vendor's accuracy claim applies almost unchanged to compliance claims.
Enkrypt AI was founded in 2022 and is based in Boston. Forbes reported a $2.35 million seed round in February 2024, led by Boldcap. That is a small company by the standards of the numbers it is now attached to.
Why a Python company bought a security company
Because it is the fourth piece, and Anaconda has been buying pieces all year.
Anaconda's 2026 acquisitions, in order
| Date | Company | Layer it fills |
|---|---|---|
| April 29, 2026 | Outerbounds (Metaflow) | Orchestration and production pipelines |
| July 2026 | Kilo Code | Agentic coding environment |
| August 4, 2026 | Enkrypt AI | Security, guardrails, compliance |
Stack those on the package distribution Anaconda already owned and you get a claim to the whole path from a developer's first prompt to a running application. Anaconda's boilerplate puts its reach at more than 52 million users, 21 billion downloads, and 95% of the Fortune 500. That distribution is the actual asset here: a security product that ships inside the tool 52 million developers already installed does not have to win a procurement fight to get deployed.
The following is our analysis, not reported fact. Three acquisitions in fourteen weeks is a company racing a window rather than building a roadmap. The bet is that AI tooling consolidates the way DevOps tooling did, and that the winners will be whoever owns the default install. It is a reasonable bet. It also means the number of independent AI security vendors keeps falling.
Why it matters if you run agents
Four things follow from this, whether or not you ever buy anything from Anaconda.
An MCP server is a dependency with a shell. That is the mental model correction most teams still need. Adding an MCP server is not like adding a library that sits inert until called with typed arguments. It is like adding a service that a language model gets to drive, with your credentials, based on text it read somewhere. Every practice you already apply to third-party dependencies applies here, plus the ones that only make sense when the caller can be talked into things.
You can audit your own surface this week, for free. Enumerate every MCP server your agents can reach, and for each one write down: the exact tool schemas exposed, what credentials it holds, what it can write to, and who maintains it. Pin versions and read the diff before upgrading, because a tool description is executable text in this design. Scope credentials down to what each tool needs. Log every tool call with arguments and results, so an incident is reconstructable. Then test indirect injection specifically: put adversarial instructions in content the tool returns, not in the user's prompt, and see whether your agent follows them.
Independence is now a question you have to ask. When the scanner that grades your MCP servers is owned by the vendor whose platform runs them, the report and the platform share an interest. That does not make the findings wrong. It does mean a clean scan from a platform's own tool is weaker evidence than a clean scan from someone with nothing to sell you. Keep at least one check in your pipeline that no vendor owns.
The evidence trail is the deliverable. If you work anywhere with a review board, the artifact that matters is not "we tested it," it is a dated record of what was tested, against what attacks, with what results, versioned alongside the model and the tool schemas. That discipline is the same one covered in Agent Evals: How Teams Test in 2026, and it gets stricter fast when the data is regulated, as in Building With Regulated Data.
What the release does not say
Open items
Price and structure. Retention terms for the Enkrypt team. Whether standalone Enkrypt pricing survives past the "no immediate changes" window. Whether scan data collected across customers becomes a shared threat feed, and on what consent basis. And the methodology behind the 25,000-server scan: how servers were sampled, how severity was assigned, and what counts as a vulnerability. None of that is disclosed, and the last one is what would make the headline number checkable.
The plumbing under your agents deserves the same scrutiny as the model
Our MCP coverage stays on what the protocol actually does, what it exposes, and how teams run it safely.
Read the MCP guideSources: Anaconda press release, "Anaconda Acquires Enkrypt AI to Secure the Trillion-Token Enterprise" (August 4, 2026); Business Wire wire copy (Austin, Texas, August 4, 2026); Anaconda blog post on the acquisition; Enkrypt AI, "We Scanned 1,000 MCP Servers" (October 9, 2025); Enkrypt AI MCP Scanner product page; Anaconda acquires Outerbounds (April 29, 2026); BigDATAwire on the Kilo Code deal (July 2026); Forbes on Enkrypt AI's seed round (February 2024). Analysis and framing by Precision AI Academy.
Common questions
How much did Anaconda pay? Not disclosed. Neither the press release nor the wire copy states a price, structure, or earnout.
Do the MCP numbers mean 73% of MCP servers are dangerous? No. They mean 73% of the servers in one vendor's scan had at least one finding, across a severity range the release does not break out. Treat it as a signal that the class of software is under-audited, then scan your own.
Is Enkrypt AI going away as a standalone product? Anaconda says there are no immediate changes to existing products, plans, or support. It does not commit beyond that.
What should I do first if I run MCP servers? Inventory them and their tool schemas, scope every credential to the minimum, log all tool calls with arguments and results, and test indirect prompt injection through content the tools return rather than through user input.