Securing AI Agents and MCP Servers: A New Trust Boundary
AI agents and MCP integrations introduce trust boundaries most security teams have never tested before. Here is where to start.
For most of the last two decades, "the LLM said something inappropriate" was the worst-case failure mode security teams worried about with AI products. That is no longer true. Once a language model can call tools, read your internal documents, send emails, or execute code on your behalf, a bad output stops being an embarrassment and starts being an incident.
Agents can now take real-world actions
The shift from "AI that answers questions" to "AI that takes actions" is the single biggest change in the threat model. An agent wired into your CRM, ticketing system, or codebase is not just generating text — it is exercising real permissions on real systems, usually with credentials that were scoped for a human, not for an autonomous process making decisions based on untrusted input.
That distinction matters because humans apply judgment before acting on suspicious instructions. An agent, by design, follows instructions — and it often cannot tell the difference between an instruction from its operator and an instruction smuggled in through the content it was asked to process.
Prompt injection as a first-class threat, not a novelty
Prompt injection stopped being a curiosity the moment agents started reading content they did not author. A support email, a shared document, a scraped web page, even a filename — any of these can carry text crafted to override the agent's original instructions if the surrounding system does not clearly separate "trusted instructions" from "untrusted content to process."
We have demonstrated this in practice: an agent asked to summarize an inbound email containing hidden instructions that redirected it to forward sensitive internal data to an external address. The email itself contained no malware, no links, nothing a traditional email security gateway would flag — the exploit was entirely in the model's interpretation of the text.
MCP servers need their own security review
The Model Context Protocol has made it dramatically easier to connect agents to tools, and that ease of integration is exactly why it deserves scrutiny. Every MCP server you stand up is a new API surface, frequently built quickly, often without the authentication and scoping rigor applied to customer-facing APIs.
We routinely find MCP servers granting a connected agent far broader tool access than the agent's actual task requires — a research agent with write access to production data, a read-only reporting agent that can also trigger downstream workflows. Least-privilege tool scoping is not optional here; it is the single most effective control against an agent being manipulated into doing something destructive.
Data exfiltration through indirect channels
Because agents often have both read access to sensitive data and some form of external communication capability — sending an email, posting to a webhook, writing to a shared document — the two together create an exfiltration path that did not exist before. An attacker does not need to breach your database directly if they can convince an agent with legitimate access to summarize and forward it on their behalf.
A testing framework for agentic systems
Assessing an agentic system requires a different playbook from a traditional web or API test, though many of the same principles apply once translated:
- Map every tool an agent can call and verify the permission scope matches the narrowest version of the agent's actual job.
- Test prompt injection using realistic untrusted content sources — documents, emails, and web pages the agent is expected to process.
- Attempt to chain a manipulated instruction into an actual tool call, not just a change in conversational output.
- Review outbound channels (email, webhooks, file writes) for opportunities to exfiltrate data the agent has legitimate read access to.
- Treat every MCP server as a standalone API requiring authentication, authorization, and logging review.
