They move data into runtime paths where protected information can be retrieved, combined, and reused by humans, systems, or AI agents. Even if the source was encrypted or tokenized, the data becomes exposed once it is decrypted or detokenized for use. That makes policy enforcement at the point of use essential.
Why This Matters for Security Teams
GenAI and MCP workflows increase sensitive data risk because they pull protected information out of its original storage boundary and into runtime, where it can be retrieved, recombined, logged, or forwarded by tools, prompts, and agents. That is the real shift: encryption and tokenization still matter at rest, but they do not protect data once it is decrypted for use. Current guidance from NIST AI 600-1 GenAI Profile and NHIMG research on Ultimate Guide to NHIs — Key Research and Survey Results both point to the same operational issue: AI systems expand the number of places where data becomes usable, not just stored.
Security teams often miss the fact that MCP tool access can make a low-risk query turn into a high-risk disclosure path. A prompt, connector, or agent action can surface credentials, customer records, internal code, or regulated content into contexts that were never intended for broad reuse. The risk is not only exfiltration; it is also overexposure through normal operation. In practice, many security teams encounter the leak after an agent has already reused the data in a downstream response, workflow, or debug log rather than through intentional data classification review.
How It Works in Practice
GenAI and MCP workflows create risk because they convert static data into live context. A model may retrieve documents, call tools, summarize records, or chain actions across systems. Each step increases the chance that sensitive data will be copied into prompt history, tool output, cache layers, telemetry, or response content. That is why data protection has to move from perimeter thinking to point-of-use controls, as reflected in OWASP Agentic AI Top 10 and NHIMG analysis of OWASP NHI Top 10.
In practice, the highest-value controls are runtime controls:
- Scope MCP tools to the minimum data domain required for the task.
- Classify prompts, retrieval sources, and tool outputs before they reach the model.
- Use short-lived, task-scoped credentials so access ends when the workflow ends.
- Prevent secrets, tokens, and regulated fields from entering model context unless explicitly required.
- Log access events without copying raw sensitive payloads into observability systems.
For MCP specifically, the exposure pattern is often worse than traditional application integration because the model can combine multiple low-risk sources into a single high-risk answer. The Analysis of Claude Code Security is a useful reminder that code assistants and tool-using agents can surface secrets simply by having broad read access, while the NIST AI profile stresses governance around data provenance, access scope, and operational monitoring. These controls tend to break down when MCP servers are configured with broad connector permissions because the model can discover and reuse more data than the original workflow designer expected.
Common Variations and Edge Cases
Tighter data controls often increase workflow friction, requiring organisations to balance user productivity against the risk of false denials, slower retrieval, and more complex policy maintenance. That tradeoff is real, especially in environments where agents need broad context to be useful.
Best practice is evolving, but current guidance suggests three common edge cases deserve special treatment. First, tokenization is not a complete safeguard if the detokenization service sits inside the same runtime path as the model. Second, RAG systems can leak sensitive content even when the source repository is locked down, because the retrieval layer becomes the effective exposure point. Third, MCP servers that bridge many systems can collapse separation of duties if tool permissions are not independently scoped and reviewed.
NHIMG’s research on the OWASP Agentic Applications Top 10 and the Top 10 NHI Issues shows why static approval models do not hold up once agents can chain tools and reuse context across steps. The practical answer is to treat data exposure as a runtime policy problem, not only a storage or encryption problem. There is no universal standard for this yet, so teams should validate controls against their own retrieval patterns, model endpoints, and MCP server permissions before broad rollout.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Covers overexposed NHI secrets in runtime tool workflows. |
| OWASP Agentic AI Top 10 | A2 | Addresses data leakage through agent tool use and prompt context. |
| CSA MAESTRO | T1 | Focuses on securing agent tool access and contextual data flow. |
| NIST AI RMF | Supports governance for GenAI data provenance and operational risk. | |
| NIST CSF 2.0 | PR.DS-1 | Protects sensitive data in transit, storage, and use. |
Map model and MCP data paths to data protection controls and verify they still apply at runtime.
