TL;DR: June’s roundup of MCP, model, and client risks highlights misconfigured servers, cross-tenant data exposure, prompt injection, and zero-click exfiltration across agentic systems, according to Pomerium and the cited sources. Access control assumptions are now failing at runtime, where agents can chain tools, leak data, and widen blast radius faster than traditional IAM review cycles.
At a glance
What this is: This is Pomerium’s June roundup of the top agentic access stories, highlighting misconfigured MCP servers, tenant boundary failures, prompt injection, and zero-click exfiltration as the month’s defining risks.
Why it matters: IAM, PAM, and NHI teams need to treat AI control planes as live access paths, because the article shows runtime behaviour can invalidate assumptions that look safe in design-time review.
Context
Agentic access is the security problem that emerges when AI systems can reach tools, data, and workflows in production. In this article, Pomerium argues that the control-plane assumptions behind MCP and agent connectivity are already breaking under real-world use, especially where access is inferred rather than enforced.
The governance gap is not just about API exposure. It is about runtime access decisions happening faster than traditional review cycles, with agents able to chain tools, inherit overbroad permissions, and move data across tenant or workflow boundaries without a human approval step.
Key questions
Q: What breaks when MCP access is not centrally enforced?
A: When MCP access is not centrally enforced, agents can bypass the sanctioned protocol and reach the same data through alternative connectors or direct application paths. That breaks policy consistency, weakens auditability, and leaves security teams with multiple uncontrolled routes to the same backend system.
Q: Why do zero-click leaks create more risk than ordinary data exposure?
A: Because the user does not need to trigger the disclosure. When an assistant or agent can surface sensitive information through normal retrieval or rendering, classic user-intent controls do not apply. Security teams need to govern retrieval scope, output handling, and delegation boundaries as part of access control.
Q: What are the signs that agentic access controls are failing?
A: The main signs are invisible tool use, delayed discovery of actions, and audit logs that explain an outcome only after it has already occurred. If a security team cannot see which agent attempted which action on which target at the moment of execution, the control is monitoring, not governing.
Q: How should teams respond when agent chaining widens blast radius during execution?
A: Teams should reduce the permissions available to each tool hop, separate data access from action authority, and validate that each step remains within the intended tenant and workflow boundary. If runtime chaining can exceed the original scope, the control model is too static.
Technical breakdown
Why MCP servers become control-plane exposure points
Model Context Protocol connects agents to tools and data sources, which makes the server side an access decision point rather than a neutral integration layer. If the server accepts broad or misconfigured access, the agent inherits that reach at runtime. In practice, that means the security question shifts from whether a model can reason to whether the surrounding access layer can constrain tool use, data scope, and execution context. In the article’s examples, the failure mode is exposed control rather than clever exploitation alone.
Practical implication: enforce policy at the MCP boundary instead of assuming upstream identity checks will contain agent behaviour.
How zero-click exfiltration changes the trust model
Zero-click exfiltration matters because it bypasses the normal assumption that a user or operator must trigger the dangerous action. With RAG-style assistants and agentic clients, sensitive data can be surfaced or forwarded through ordinary workflows when prompt handling, retrieval scope, or response rendering is unsafe. That breaks a core IAM assumption: access review and user intent are not enough when the system can disclose data without an explicit click, approval, or export action.
Practical implication: treat data retrieval and response generation as governed access events, not just application output.
Why cross-tenant leakage is an identity boundary failure
Cross-tenant leakage shows that authorisation is only as strong as the boundary enforcement behind it. If an agent can view another tenant’s data, or a prompt can steer a server into a broader context than intended, then the system has failed at isolation, not just authentication. For identity teams, the important detail is that tenant separation, delegation scope, and session context all need to survive agent chaining. Without that, a valid session can still become a breach path.
Practical implication: validate tenant isolation and delegation scope at every step where an agent can switch tools, contexts, or data sets.
Threat narrative
Attacker objective: The attacker wants to turn a trusted agentic control plane into a data exfiltration and workflow abuse channel without needing interactive user action.
- Entry begins when MCP servers, agent integrations, or assistant endpoints are exposed to the public web or to weakly constrained enterprise workflows.
- Credential and context abuse follow when agents inherit permissions, prompts, or stored keys that were never meant to be reused across tools or tenants.
- Escalation occurs when prompt injection, workflow chaining, or misconfigured authorisation lets the agent reach wider data sets than intended.
- Impact is zero-click data exposure, repository compromise, or cross-tenant leakage that bypasses the normal human approval path.
Breaches seen in the wild
- Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
- iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic access creates an identity control-plane problem, not just an AI security problem. The article’s examples show that MCP, assistant workflows, and agent chaining turn access decisions into runtime events. That shifts the governance burden from static authorisation design to continuous enforcement at the moment tools and data are actually used. Practitioners should treat agentic access as a live control-plane, not a feature layer.
Runtime enforcement is now the security boundary that matters. A configuration review can tell you what should happen, but it cannot prove what an agent will do once prompts, tools, and retrieval paths combine. The article’s central signal is that access control assumptions fail when execution context changes faster than governance cycles. Identity teams need to judge access by observed behaviour, not declared policy.
Zero-click exfiltration is a disclosure model failure, not a user-training problem. If sensitive information can leave the environment without an intentional action from the operator, then the control failure sits in retrieval, rendering, and delegation scope. That matters because IAM reviews often focus on who can log in, while the real risk is what the system can disclose after login. The practitioner conclusion is straightforward: disclosure paths need to be governed as tightly as entry paths.
Tool chaining widens blast radius faster than traditional access reviews can see. Once an agent can move across systems in a single task, review cadences and recertification workflows lose their timing advantage. The article points to a market shift toward continuous, context-aware enforcement because identity scope can expand and contract inside one runtime session. Security teams should re-evaluate whether their controls still assume stable sessions and human-paced decisions.
Ephemeral access still leaves durable governance debt when the boundary is weak. Even short-lived agent actions can create lasting exposure if the control plane allows overbroad retrieval, cross-tenant reach, or stored secrets in configuration files. Ephemeral credential trust debt: access that looks temporary on paper can still create persistent risk when the surrounding policy boundary is not equally ephemeral. The practitioner implication is to measure the boundary, not just the token lifetime.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Agentic access is forcing identity teams to move enforcement to runtime. Design-time approval is no longer enough when tool choice, data retrieval, and disclosure can happen inside one execution path. The practical shift is toward policy checks at the point of access, with observability over how agents actually combine tools.
Continuous verification now applies to agentic workflows as much as to human sessions. The control problem is not simply who authenticated, but whether a session can still be trusted after the agent starts chaining actions. That is why agent identity programmes need visibility into tool hops, context changes, and output paths.
24,008 unique secrets were exposed in MCP configuration files in 2025 alone, according to the State of Secrets Sprawl 2026. That scale shows why configuration hygiene around agent infrastructure is already an access-control issue, not just a developer hygiene issue.
For practitioners
- Enforce policy at the MCP boundary Bind access decisions to the tool invocation itself, including identity, intent, and context, so agents cannot inherit broader reach from upstream sessions.
- Separate retrieval scope from response scope Limit what an agent can fetch, and independently constrain what it can disclose, so retrieved data does not become uncontrolled output.
- Test tenant isolation under agent chaining Exercise cross-tenant and cross-workflow scenarios where one agent call leads into another, then confirm the boundary survives tool handoff and prompt influence.
- Scan MCP configurations for exposed secrets Check configuration files, server manifests, and deployment artifacts for hard-coded tokens, API keys, and other reusable credentials that expand attack surface.
- Review whether review cycles match runtime speed Compare access review and recertification cadences against how quickly agents can obtain, use, and discard permissions within a single task.
Key takeaways
- Agentic access turns control-plane design into a live identity problem because runtime decisions can outpace static governance.
- The article’s examples show that cross-tenant leakage, zero-click disclosure, and prompt injection all exploit weak boundary enforcement rather than simple login failure.
- Practitioners should move control to the moment of access, then test whether their policy survives tool chaining, context switches, and disclosure paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The article centers on agents using tools in ways that widen exposure and violate intended scope. |
| Recommendation — Restrict tool permissions and validate every agent tool call against intended task scope. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The roundup highlights exposed secrets in MCP configurations and agent-connected workflows. |
| NHI-05 — Overprivileged NHI | Agentic access breaks when the control plane grants broader rights than the task requires. | |
| Recommendation — Scan agent configuration paths for leaked secrets and revoke exposed credentials immediately. Reduce agent and MCP privileges to the minimum scope needed for each workflow. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Service Identification and Authentication | Agent-to-tool interactions are machine-to-machine access events that need governed authentication. |
| Recommendation — Apply IA-9 controls so agent and service identities are authenticated before any tool access. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Prompt injection and tool chaining create the same access and movement outcomes as attack-path exploitation. |
| Recommendation — Map agentic abuse paths to credential access and lateral movement to prioritize detection coverage. | ||
Key terms
- Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.
- Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
- Zero-Click Exfiltration: Zero-click exfiltration is the theft of data without any user interaction. In agentic AI environments, a hidden email, file, or calendar payload can trigger an agent to browse, summarize, fetch documents, and send content externally before the user opens anything or sees a prompt.
- Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org