MCP-connected agents can retrieve data directly from enterprise systems, so sensitive information may enter AI workflows without a person copying it into a prompt. That creates a delegated retrieval path, which expands the attack and compliance surface. Organisations need policy controls on what the agent may retrieve and what may be passed onward to the model.
Why This Matters for Security Teams
MCP-connected agents change the leakage model because they do not rely on a user manually pasting content into a prompt. Instead, they can query mailboxes, ticketing systems, file stores, knowledge bases, and other business systems on behalf of a session. That creates a delegated retrieval path where exposure can happen through normal-looking automation rather than an obvious exfiltration event. This is a core concern in the OWASP Agentic AI Top 10, especially where tool abuse, overbroad permissions, and inadequate output controls are involved.
The practical risk is not only that an agent can see more data, but that it can combine, summarise, cache, or forward that data into another system or model context. Once that happens, traditional DLP thinking becomes harder to apply because the data may not leave the environment in a single packet or file. Security teams often underestimate the trust placed in the tool layer and the downstream model, even when the original user never intended a sensitive record to be exposed. In practice, many security teams encounter leakage only after an agent has already retrieved and propagated sensitive data through a routine workflow, rather than through intentional testing.
How It Works in Practice
An MCP-connected agent typically operates with three linked decision points: what it may retrieve, how much of that retrieved content it may retain in context, and what it may pass onward to a model or another tool. If any of those steps are too permissive, the agent can surface sensitive material that would otherwise remain segmented by application controls. The risk increases when the agent has broad read access across systems containing personal data, source code, incident records, or privileged operational notes.
Effective controls start with data and tool scoping, not just prompt filtering. Security teams should define which MCP servers are approved, which resources each server can query, and which record types are out of bounds. They should also constrain the agent’s memory, tool chaining, and export behaviour so that a retrieved secret, customer record, or internal incident summary cannot be silently copied into another workflow. The NIST AI Risk Management Framework is useful here because it treats AI risk as a lifecycle issue, not a single input-validation problem.
- Apply least privilege at the MCP tool and connector layer, not only at the user account layer.
- Separate read access from summarisation and export permissions where the platform supports it.
- Log retrieved objects, tool calls, and outbound transmissions so the full data path is auditable.
- Classify high-risk sources such as HR, legal, finance, secrets stores, and incident systems.
For threat modeling, the MITRE ATLAS adversarial AI threat matrix helps teams think about prompt injection, tool misuse, and inference-time manipulation, while the CSA MAESTRO agentic AI threat modeling framework is useful for mapping trust boundaries across the agent, tools, and orchestration layer. These controls tend to break down when MCP connectors are granted broad enterprise read access in environments that lack per-object logging because the agent can retrieve and relay sensitive content without a discrete policy checkpoint.
Common Variations and Edge Cases
Tighter retrieval controls often increase operational friction, requiring organisations to balance automation value against governance overhead. That tradeoff is real in environments where agents are expected to answer broad questions across many repositories, because restrictive policies can reduce usefulness while permissive policies raise leakage risk.
Current guidance suggests that the highest-risk cases are not simple question-and-answer workflows, but agents that can chain retrieval with action. For example, a support agent may pull a customer case, summarise it, create a ticket update, and then send a follow-up email. Each step widens the exposure surface. The risk is even higher where retrieval includes regulated data, credentials, or internal security findings, since downstream leakage may trigger privacy, contractual, or incident reporting obligations. The OWASP Top 10 for Agentic Applications 2026 is especially relevant when evaluating tool authorization, agent autonomy, and output handling.
There is no universal standard for this yet, but best practice is evolving toward policy-based retrieval filters, approval gates for sensitive sources, and explicit output redaction before model forwarding. In some environments, especially those with legacy content stores or shadow data copies, teams may need to accept that perfect containment is unrealistic and instead focus on monitoring, exception handling, and rapid revocation of risky connectors. Where identity and privilege governance are weak, agent leakage risk becomes harder to separate from ordinary access sprawl, which is why this issue often sits at the intersection of AI security and Non-Human Identity governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATLAS and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | LLM07 | Tool misuse and overbroad autonomy are central drivers of MCP-driven leakage. |
| NIST AI RMF | AI risk management covers lifecycle governance for delegated retrieval and output sharing. | |
| MITRE ATLAS | AML.TA0002 | Prompt and tool manipulation map to adversarial AI behaviours that expose data. |
| CSA MAESTRO | MAESTRO helps map trust boundaries across agent, tool, and orchestration layers. | |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access is essential when agents can query enterprise systems directly. |
Define AI risk ownership, then control retrieval, retention, and disclosure across the full agent lifecycle.
