AI agent and MCP security platforms expose a legacy DLP gap

At a glance

What this is: This is a vendor analysis of AI agent and MCP security platforms, and its central finding is that legacy DLP misses the control requirements created by autonomous tool calls and chained workflows.

Why it matters: IAM, IGA, PAM, and NHI teams need to treat AI-driven data movement as a governed access problem, because visibility without tool-level enforcement leaves machine-speed exfiltration paths open.

Context

AI agent and MCP security has become a data-governance problem, not just a detection problem. Once autonomous systems can access databases, file systems, SaaS apps, and local tools, controls built for human-driven copy, paste, and upload workflows stop describing the actual risk surface.

Nightfall's analysis argues that legacy DLP breaks down where AI agents act through tool calls, desktop coding assistants, and protocol-level workflows. The gap is not only in coverage, but in whether security teams can govern what the agent can read, write, and forward in real time.

For identity and access programmes, the issue is broader than exfiltration prevention. It is about whether access policy can keep pace with non-human actors that chain actions together faster than review, coaching, or manual approval loops were designed to operate.

Key questions

Q: What breaks when AI agents are governed with legacy DLP controls?

A: Legacy DLP breaks because it assumes data moves through predictable human actions such as email, uploads, and endpoint copy events. AI agents use different transports, including IDE hooks, browsers, local MCP servers, and chained tool calls. If controls cannot see or stop those paths in real time, visibility turns into after-the-fact logging rather than effective prevention.

Q: Why do AI agents and MCP tools create a different access-control problem than SaaS DLP?

A: They create a different problem because the governing unit is not just the file or message, but the tool invocation itself. MCP can expose databases, file systems, and APIs to agents, which means access control has to decide whether a specific action is permitted before the tool executes.

Q: What are the signs that an AI data security programme is missing desktop workflows?

A: The clearest signs are inconsistent policy coverage across local IDEs, prompt activity that appears outside central SaaS logs, and agent actions that cannot be traced from request to output. When those workflows are invisible, the programme is relying on partial telemetry rather than actual control.

Q: How should security teams handle approval for sensitive AI agent actions that happen asynchronously?

A: Security teams should place approval in a separate authentication step that is bound to the exact action, not to the agent's general session. The approval should flow through a human-readable request, a scoped token, and a clear audit record. That keeps the control tied to the decision being made rather than to the browser session that started it.

Technical breakdown

Why legacy DLP misses AI agent data movement

Legacy DLP was tuned for human users moving data through email, uploads, copy and paste, and browser activity. AI agents change the control plane because they can pull data through tool calls, pass outputs into other tools, and continue the sequence without a human deciding each step. That means the security event is no longer a single transfer. It is a chain of reads, transformations, and writes that may never appear as a classic exfiltration attempt. In practice, the architecture has to understand the action context, not just the content payload.

Practical implication: move from content-only DLP rules to controls that inspect AI tool calls and chained actions in context.

MCP security requires protocol-level enforcement

Model Context Protocol gives AI agents a standard way to reach databases, file systems, and APIs through local stdio or remote HTTP workflows. That makes the protocol layer part of the trust boundary, because the important question is not only whether traffic exists, but which tool the agent is invoking and what action that tool can perform. Read, read/write, and destructive actions create very different governance requirements. If enforcement happens only at the network perimeter, the organisation sees connectivity but not intent or authority.

Practical implication: classify MCP tools by action risk and enforce policy at the tool-call layer, not only at the perimeter.

Desktop AI agent coverage is a blind spot in mixed work environments

A growing amount of AI-assisted work now happens inside local IDEs and desktop clients such as Cursor, Claude Code, VS Code, and Claude Desktop. Those flows are harder to govern because they sit closer to the operator and farther from the central SaaS controls many DLP programmes rely on. Local tools can invoke MCP servers, produce prompts, and forward outputs with very limited visibility if endpoint coverage is missing. The result is a control gap between enterprise policy and the actual place where data leaves or changes hands.

Practical implication: extend monitoring and blocking to endpoint-based AI workflows, not just cloud applications and mail gateways.

Breaches seen in the wild

• postmark-mcp malicious MCP server 2025: A fake Postmark MCP server on npm quietly BCC'd every email AI agents sent through it to an attacker, using victims' own Postmark tokens.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy DLP is the wrong control model for machine-speed data movement: The control assumption behind traditional DLP is that a human user creates a discrete event that can be observed, tuned, and interrupted. AI agents break that model because one prompt can produce a chain of retrievals, transformations, and transfers that never maps cleanly to human review cycles. The implication is that data governance now needs execution-aware controls, not just content inspection.

MCP has turned tool access into a governance boundary: Once an agent can reach databases, file systems, and APIs through MCP, the main risk is no longer only data content but delegated action authority. That shifts the question from 'what data exists?' to 'what can this identity do through its tools?' Practitioners should treat protocol-level access as a first-class control surface, especially where read/write and destructive tools coexist.

Desktop AI workflows expose the next control gap: Security programmes that only instrument SaaS and browser traffic will miss a large portion of AI-assisted development and analysis work. Local clients such as Cursor and Claude Code collapse the distance between the operator and the tool chain, which weakens visibility and makes policy enforcement inconsistent across environments. The result is a programme gap that looks like adoption success until an incident shows the blind spot.

Real-time control is now the defining requirement for AI data security: Visibility alone does not govern autonomous systems. The named concept here is the machine-speed enforcement gap, where the cadence of AI action outpaces human approval, manual review, and retrospective alerting. That gap determines whether AI adoption is safe enough to permit in production, so teams should evaluate controls by interruption power, not dashboard quality.

AI data security is converging with identity governance: AI agents are becoming non-human actors with differentiated access, tool scopes, and delegated authority, which means the same governance logic used for service accounts and privileged workflows now has to extend to agentic systems. The practical conclusion is that access reviews, approvals, and revocation models need to account for who or what is moving the data, and through which protocol.

From our research library:

• Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
• Read next: AI Agent Authorisation Guide

What this signals

Machine-speed enforcement gap: AI programmes fail when they rely on visibility that cannot interrupt tool calls in time. The control plane has to move closer to execution, because once an agent can read, transform, and forward data inside one task, review-only governance arrives too late.

Teams should expect endpoint-based AI workflows to become the hardest part of the control estate to govern. Desktop clients and local MCP usage create a split between policy on paper and policy in practice, so programme owners need consistent coverage across browser, SaaS, and development tools.

According to the 2026 Infrastructure Identity Survey, 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years. That expectation makes protocol-level enforcement and delegated access governance a present requirement, not a future planning exercise.

For practitioners

• Define AI tool-call enforcement points Map where agents invoke MCP tools, desktop clients, and SaaS connectors, then decide which actions require block, coach, redact, or approval controls before execution.
• Extend policy coverage to endpoint AI workflows Include Cursor, Claude Code, VS Code, and similar desktop clients in your control scope so local agent activity does not bypass cloud-only monitoring.
• Separate read, read/write, and destructive MCP actions Classify tools by operational risk so the most sensitive actions receive the strictest enforcement and the least ambiguity in policy decisions.
• Measure enforcement quality, not just visibility Track whether controls can stop or moderate risky transfers in real time, rather than only detecting them after data has already moved.

Key takeaways

• Legacy DLP leaves a structural gap when AI agents move data through chained tool calls and local workflows that were never built into human-centric policies.
• The article's core issue is control, not visibility alone, because real-time blocking, coaching, redaction, and approval determine whether AI adoption can be governed safely.
• MCP and desktop AI clients expand the enforcement boundary to the protocol and endpoint layers, where identity and access decisions must happen before the action completes.

Key terms

• Agentic security: The practice of governing software actors that can choose actions, tools, and timing in production workflows. It extends identity, authorization, logging, and lifecycle control to agents so their behaviour is tied to a verifiable principal and a revocable permission set.
• MCP Security: MCP security is the set of controls that protect Model Context Protocol connections between agents, tools, and data sources. It covers connector permissions, secret handling, and policy enforcement because the protocol can become a direct path from agent intent to enterprise action.
• Desktop AI workflow: A desktop AI workflow is an agent-assisted task carried out in a local client or IDE rather than only in a central cloud app. These workflows matter because they often bypass the visibility and enforcement assumptions built into browser-centric or SaaS-only monitoring.
• Machine-speed enforcement gap: A machine-speed enforcement gap exists when policy can observe an AI action but cannot interrupt it in time. In practice, the risk appears when blocking, coaching, or approval arrives after the agent has already completed the sensitive data movement.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.