AI agent and MCP security needs runtime data controls

At a glance

What this is: This analysis argues that AI agent and MCP security now depends on runtime data controls because conventional DLP was built for human-driven movement, not autonomous tool calls and machine-speed workflows.

Why it matters: For IAM and NHI practitioners, the key issue is that access, transfer, and enforcement are now happening inside agentic workflows, so control has to move closer to issuance and execution.

By the numbers:

• Nightfall reports 95% detection precision out of the box and a 95% reduction in false positives.
• In Gravitee’s 2026 research cited by Nightfall, 88% of surveyed organizations reported confirmed or suspected AI agent security or privacy incidents within the previous year.

Context

AI agent security is now a data-movement problem as much as an access-control problem. Agents, copilots, coding assistants, and MCP servers can access, transform, and transfer sensitive information without a human approving each step, which means traditional DLP and policy review models can miss the actual point of loss. The primary governance gap is that visibility alone does not stop machine-speed movement.

MCP adds a structured way for agents to call tools and retrieve data, but it also creates a larger control surface across local and remote workflows. For identity and governance teams, the important question is not whether an agent can connect, but whether its tool calls, outputs, and downstream data handling are governed in real time. That makes runtime enforcement a practical requirement rather than an advanced option.

The subject here is not only agent security in the abstract. It is the boundary between detection, data control, and access governance when non-human identities can act continuously across applications, endpoints, and model-driven workflows.

Key questions

Q: How should security teams govern AI agent identities in MCP workflows?

A: Treat each agent as a governed non-human identity with an owner, task scope, expiry window, and revocation path. The key control is not just authentication at start-up, but continuous authorization at tool boundaries so the agent cannot expand its own effective privilege through chained actions.

Q: Why do MCP-based AI workflows create more risk than isolated integrations?

A: Because risk emerges from composition. A connector may be safe on its own, but once a host, model, and downstream action tool are combined, the system can execute behaviours no component owner intended. Governance has to assess the whole path from input to action, not just the exposed API.

Q: What breaks when DLP cannot interpret MCP tool calls in real time?

A: The control fails at the exact moment data is requested or emitted, which means the agent can complete the transfer before a human or queue-based workflow reacts. In practice, that creates blind spots around exfiltration, approval, and evidentiary logging.

Q: What should teams do when agentic workflows operate beyond human review?

A: They should move from periodic review to continuous enforcement, and they should treat delegated agent access as a live governance issue. When an agent can read, transform, and send data autonomously, the control objective is to constrain runtime behavior, not just document intent.

Technical breakdown

Why MCP tool calls change the control surface

Model Context Protocol gives AI systems a structured way to call tools and move data between applications, but that structure also widens the security boundary. Instead of a single user action, a workflow can include multiple machine-generated requests, responses, and downstream transformations that are difficult for legacy DLP to classify. Many controls were built to inspect files, emails, or endpoints in isolation, not to reconstruct an agent’s chain of tool calls. In practice, the control problem shifts from reading content after the fact to understanding the context in which a model requested it and how that content is about to be used.

Practical implication: Treat MCP traffic as a governed execution path, not just another data channel.

Why conventional DLP struggles with autonomous agent workflows

Traditional DLP commonly assumes a human-originated event such as a file share, copy action, or email send. AI agents break that assumption by chaining prompts, tool calls, and responses at a pace that can outstrip review or alerting. Some architectures can still detect parts of the path at the endpoint, browser, API, network, or gateway layer, but partial visibility is not the same as inline control. If the policy engine only sees the final transfer, it has already missed the decision point where the data should have been blocked, redacted, or approved. That is why runtime inspection matters more than retrospective logging.

Practical implication: Move policy enforcement to the point where the agent requests or emits data.

What real-time enforcement changes for AI data governance

Real-time controls let security teams block, redact, coach, or route for approval while the agent is still acting, which is materially different from observing the event afterward. This matters because autonomous workflows can complete sensitive actions before a human notices the request in a queue. Inline controls also improve auditability, since the policy decision is tied to the actual data movement rather than an inferred after-action record. For identity teams, this is the same governance principle as just-in-time access, applied to machine-speed data transfer and agent execution.

Practical implication: Use runtime enforcement to prevent exfiltration at the moment of movement, not during post-event review.

Threat narrative

Attacker objective: The objective is to use agentic workflows as a high-speed data exfiltration path that bypasses human review and conventional DLP assumptions.

1. Entry occurs when an AI agent or MCP-connected workflow gains access to sensitive data or tools through a configured integration or local endpoint.
2. Credential and tool access are then used at machine speed to request, transform, and move information across prompts, tool calls, and responses.
3. Impact follows when the workflow transfers data beyond intended boundaries without a human in the loop, leaving exfiltration and audit blind spots behind.

Breaches seen in the wild

• Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime control is now the deciding boundary for AI data security. Visibility, classification, and posture reporting matter, but they do not stop a model from moving data once the workflow is live. The security model has shifted from where data sits to how data is acted on. That makes inline decisioning the control plane that matters most for practitioners managing agentic risk.

MCP creates a new NHI governance problem, not just a new integration pattern. When an agent uses tool calls to retrieve and move information, the workflow behaves like a non-human identity with delegated authority. That means inventory, approval, and scope controls need to track the agent’s effective access, not just the underlying application account. The governance failure is assuming the tool call is only an application event when it may actually be an identity event.

Identity teams should treat agentic data flow as a privilege-scope problem. If the agent can read, transform, and transmit data without synchronous enforcement, the effective blast radius is defined by runtime control, not policy documentation. This is where NHI governance and data security converge. Practitioners should align controls to the actual execution surface and not rely on after-the-fact review.

MCP security exposure is becoming an operational sprawl issue. Public registries, local deployments, and remote tool endpoints make it easy for shadow MCP servers to appear outside central oversight. That mirrors the broader NHI problem of unmanaged credentials and untracked service surfaces. The practical conclusion is to govern discovery and enforcement together, because one without the other leaves a false sense of control.

Agentic AI security is moving toward continuous enforcement, not static approval. Once agents can act on behalf of users and systems in real time, periodic review cannot keep pace with the risk. The control model has to assume dynamic behavior, delegated action, and machine-speed transfer. For security leaders, that means runtime policy is becoming part of identity governance, not a separate DLP concern.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: Agentic AI Security Guide

What this signals

Runtime data controls are becoming the practical answer to agentic risk. Organizations cannot rely on visibility alone when AI systems move sensitive content through prompts, tool calls, and downstream transfers faster than human review can keep pace. The governance model has to shift to decisioning at the moment of action, which is why inline enforcement now matters more than post-event remediation.

Agentic data sprawl is also an identity problem. MCP servers, coding assistants, and copilots are behaving like delegated non-human actors, so inventory and scope control need to follow the effective authority of the workflow. This is where NHI governance and data security meet, because the same policy gap that leaves secrets exposed also leaves machine-speed movement uncontained.

AI agents are no longer a future-state concern. 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey. That expectation means teams should prepare governance, enforcement, and audit controls for autonomous operation now, not after agents become the default operating layer.

For practitioners

• Implement inline controls for agentic data movement Block, redact, or route for approval at the point where AI agents call tools or emit sensitive content, not after the event appears in a queue.
• Inventory MCP servers across managed endpoints and registries Create a live inventory of public, local, and remote MCP servers so shadow tool surfaces do not sit outside governance and policy scope.
• Scope agent permissions to the minimum usable data set Tie each agent or MCP workflow to the smallest data and tool scope needed for the task, and review whether the delegated access still matches the use case.
• Test prompt and tool-call inspection against real workflows Validate whether your controls can inspect prompts, tool calls, tool responses, and shell commands in the same workflow path before production use.

Key takeaways

• AI agents and MCP servers expose a governance gap that conventional DLP cannot close on its own, because machine-speed workflows outpace human review.
• The operational issue is not just visibility into data movement, but control at the moment an agent requests, transforms, or transfers sensitive content.
• Practitioners should treat agentic workflows as runtime policy problems, combining discovery, scope limitation, and inline enforcement across the surfaces where data actually moves.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Shadow MCP Server: An MCP server that exists in an environment without being fully visible, approved, or governed by the teams responsible for identity and access. In practice, it becomes a hidden trust path for tools, data, and credentials, especially when developers install it directly into agent workflows.
• Agentic Data Flow: Agentic data flow is the movement of information through AI systems that can process, route, or redistribute content with broad permissions. It creates a governance challenge because access decisions and data movement can occur without a human triggering every step, which requires identity-aware and runtime controls.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners align access, lifecycle, and runtime controls across the systems their programmes now depend on.