TL;DR: AI agents and MCP servers are moving sensitive data at machine speed through channels that traditional DLP was never built to inspect, according to Nightfall's 2026 review of agentic data security platforms. The practical problem is not visibility alone, but whether policy enforcement can follow tool calls, local stdio traffic, and autonomous workflows in real time.
At a glance
What this is: Nightfall’s report argues that AI agent and MCP security now requires runtime policy enforcement across agent workflows, local MCP traffic, and IDE-integrated tools.
Why it matters: This matters because IAM and security teams must govern machine-speed data movement as an access and control problem, not just a visibility problem, across NHI, autonomous, and human-operated workflows.
Context
AI agent and MCP security is the problem of controlling how sensitive data moves through non-human and semi-autonomous execution paths. In this article, Nightfall argues that the old assumption of data flowing through human-visible channels no longer holds when agents, copilots, coding assistants, and MCP tool calls can move information at machine speed.
The governance gap is not just visibility. Network- and SaaS-centric DLP often misses local stdio MCP traffic, IDE-embedded agents, and chained workflows unless endpoint, IDE, or agent telemetry is present. That makes runtime policy control the core issue for AI agent policy enforcement, not a secondary enhancement.
For IAM and security leaders, the article frames this as an identity-and-data boundary problem across human activity, NHI access, and autonomous execution. The operational question is whether controls can follow the action where it happens, rather than waiting for after-the-fact review.
Key questions
A: Standard DLP often misses MCP traffic because it sits at the network, file, or SaaS policy layer, not inside the tool-call path. That means sensitive rows, files, and attachments can pass straight into the model context window before any control sees them. The result is blind spots in redaction, auditing, and incident investigation.
Q: Why do AI agent access mistakes create so much more risk than human access mistakes?
A: AI systems can execute faster, chain more actions, and move data through multiple surfaces without waiting for human approval between steps. When access is broader than the task requires, the blast radius expands quickly across SaaS, IDEs, and MCP tools, which is why runtime enforcement and least privilege have to be paired.
Q: What are the signs that MCP governance is failing?
A: Common signs include agents reaching systems outside their intended workflow, incomplete audit trails for tool use, and data retrieval that cannot be tied back to a clear business purpose. If teams cannot reconstruct who invoked which tool, against which resource, and why, the MCP layer is already operating with insufficient control.
Q: When should security teams use MCP gateways instead of relying only on endpoint DLP?
A: Use MCP gateways when your main risk is policy enforcement at the tool layer and you need to govern which servers, tools, and access paths agents can use. Endpoint DLP still matters, but gateway controls are better when the execution surface itself is the issue and the policy must follow each tool call.
Technical breakdown
Why legacy DLP misses local MCP and IDE traffic
Legacy DLP was designed around human-mediated channels such as email, file transfer, and browser uploads. MCP changes the transport layer by letting AI tools exchange structured requests and responses over local stdio or remote HTTP/SSE connections, often inside IDEs or agent runtimes. If the security stack only watches network gateways or SaaS APIs, it sees the symptom after the data has already moved. That is why agent telemetry, endpoint hooks, and IDE interception matter. The technical problem is not just content detection but placement: enforcement has to sit where the tool call is made, not where the file eventually lands.
Practical implication: Place inspection and enforcement at the agent, endpoint, or IDE layer when MCP traffic never touches a traditional DLP checkpoint.
What runtime policy control changes for AI agents
Runtime policy control means deciding whether a data action is allowed at the moment it is attempted, based on context such as destination, sensitivity, tool type, and risk score. In agentic workflows, a single session may combine prompt ingestion, tool selection, document retrieval, and outbound sharing without human intervention between steps. A dashboard can describe that sequence, but it cannot stop the next move. Real-time controls such as block, redact, quarantine, coach, and permission restriction matter because they change the outcome of the action instead of merely recording it.
Practical implication: Design controls to enforce decisions during execution, not only to review activity after the session completes.
Why shadow MCP discovery is now part of data security
MCP discovery is effectively asset discovery for an emerging identity surface. If local and remote MCP servers are not inventoried, organisations cannot know which tools can read, write, or trigger destructive actions on sensitive data. That creates a shadow AI problem where an unapproved server becomes a policy blind spot even if the rest of the environment is monitored. Tool classification by capability is important because read-only access, read-write access, and destructive access create different blast radii. Without discovery, policy cannot be scoped to the actual execution surface.
Practical implication: Inventory MCP servers and classify tool capability before allowing agents to use them in production workflows.
Threat narrative
Attacker objective: The objective is to move sensitive data out of governed channels and into attacker-controlled or uncontrolled destinations without triggering existing DLP controls.
- Entry occurs through AI agents, copilots, or IDE-integrated tools that are allowed to process sensitive information and call MCP servers.
- Credentialed or authorised tool access is then used to move data through local stdio or remote MCP channels that traditional DLP does not inspect.
- The impact is unauthorised exposure or exfiltration of sensitive material, with shadow MCP servers and chained workflows expanding the blast radius.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Runtime policy control is now the governing primitive for agentic data movement. The article shows that visibility without enforcement is no longer sufficient when AI agents and MCP servers can move data through paths legacy DLP does not inspect. Security programmes that still treat monitoring as the end state are already behind the operational reality. Practitioners should re-centre control design on the moment of data movement, not the later moment of review.
Shadow MCP discovery is becoming an identity inventory problem, not just a tooling problem. Unapproved local and remote MCP servers create a hidden execution surface where policy cannot be applied consistently. That shifts the governance question from whether a server exists to whether its tool capability, ownership, and risk tier are known. The practitioner implication is straightforward: unmanaged MCP is unmanaged access.
Least privilege for AI systems only matters if the policy engine can act at runtime. The article’s figures show how often organisations already over-grant access to AI systems, and how sharply incident rates rise when access is not properly scoped. That pattern confirms a familiar control truth: excessive privilege becomes operationally real only when enforcement cannot keep pace with the workflow. Practitioners should treat AI access scope as a live control plane, not a provisioning-time artifact.
Identity blast radius is now determined by tool reach, not just account reach. An agent with broad access to read, write, and destructive MCP tools can amplify a single policy miss into cross-system exposure. This is where NHI governance and autonomous workflow governance converge: the same access can be safe in one tool and dangerous in another. The implication is that policy must classify not only the identity but also the action surface it can invoke.
Real-time remediation is replacing dashboard-centric security operations for agentic environments. Blocking, redacting, quarantining, and permission restriction matter because agentic flows compress decision windows to seconds. A review queue that depends on human triage cannot protect data already moving through chained assistant workflows. The field should treat enforcement latency as a core risk metric, not an implementation detail.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Read next: MCP Security Guide
What this signals
Runtime policy control is becoming the dividing line between observability and governance. When AI agents move data through MCP, the reader should assume that dashboard-only controls are insufficient unless enforcement can occur at the same layer where the tool call is made.
Shadow MCP is the new blind spot to inventory. If local and remote MCP servers are not discovered, policy cannot be applied consistently, and unmanaged tool surfaces become hidden data pathways. That makes MCP discovery a programme-level control, not a one-time scan.
AI access has to be re-scoped against task reality. The gap between what an AI system can do and what it should do is now large enough to demand continuous review of permissions, tool reach, and destructive capability.
For practitioners
- Map MCP traffic paths to enforcement points Identify where local stdio, IDE hooks, and remote MCP traffic enter your environment, then place inspection and policy enforcement at those points instead of relying only on network DLP.
- Classify MCP tool capability by blast radius Separate read-only, read-write, and destructive MCP tools so policy can reflect what an agent can actually do rather than what server it merely reaches.
- Inventory shadow MCP servers and owners Maintain a register of approved local and remote MCP servers, their owning teams, and their intended use so unmanaged servers cannot silently become policy gaps.
- Move from visibility to runtime enforcement Use block, redact, quarantine, coaching, or permission restriction actions that can intervene during the data move, not after an investigation is opened.
- Re-tune AI access scope against actual job function Compare the access you grant AI systems with the minimum access needed for the task, then remove broad permissions that are only justified by convenience.
Key takeaways
- AI agent and MCP security now depends on enforcement that can act at the point of data movement, not just on logs and dashboards.
- Shadow MCP servers and IDE-integrated tools create hidden execution surfaces that traditional DLP often cannot see or govern.
- Organisations need runtime policy control, tool capability classification, and least-privilege AI access to reduce the blast radius of agentic workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | MCP workflows and agent traffic can expose sensitive data and secrets if not controlled at runtime. |
| NHI-05 — Overprivileged NHI | The report shows AI systems often receive broader access than their tasks require. | |
| NHI-10 — Human Use of NHI | The article covers humans, copilots, and AI agents sharing control paths and data channels. | |
| Recommendation — Enforce NHI-02 by scanning agent and MCP flows for exposed secrets and blocking unsafe movement. Apply NHI-05 by scoping AI agent permissions to the minimum task-specific access required. Separate human and machine data paths so shared workflows do not blur accountability for NHI actions. | ||
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Agentic tools can route sensitive data through MCP and IDE actions that exceed intended use. |
| Recommendation — Restrict tool permissions and inspect tool calls to prevent unsafe agentic misuse. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Runtime policy control and least privilege are central to governing agent access scope. |
| Recommendation — Review and tighten access permissions for AI systems so authorizations match actual task needs. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The threat pattern centers on sensitive data access and downstream movement through agent channels. |
| Recommendation — Map agent and MCP exposure paths to credential access and exfiltration tactics in detection content. | ||
Key terms
- Runtime Policy Enforcement: Runtime policy enforcement evaluates a request at the moment it is executed instead of relying only on preconfigured permissions. For AI agents, this allows decisions to reflect current context, target sensitivity, and behavioural signals rather than static assumptions.
- Shadow MCP: Shadow MCP is an unauthorized or ungoverned use of the Model Context Protocol inside an organization. It appears when AI agents, scripts, or tools connect to data or actions through MCP servers without security review, inventory, policy control, or monitoring. This creates hidden access paths, data exposure, and weak accountability.
- Tool Capability Classification: Tool capability classification is the practice of labeling an AI tool or MCP action by what it can actually do, such as read, write, or destructive actions. This is essential because a single agent identity can have very different risk profiles depending on the tools it is allowed to invoke.
- Agentic Data Flow: Agentic data flow is the movement of information through AI systems that can process, route, or redistribute content with broad permissions. It creates a governance challenge because access decisions and data movement can occur without a human triggering every step, which requires identity-aware and runtime controls.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org