AI agent identity threats: why MCP and token vaults matter

At a glance

What this is: This analysis argues that MCP and token vaults make AI agents operationally useful but also create identity security risks around privilege accumulation, prompt injection, and token theft.

Why it matters: IAM, PAM, and NHI teams need to treat AI agent connectivity as a governed identity problem because dynamic access, short-lived tokens, and tool execution change how trust and entitlement must be controlled.

👉 Read Unosecur's analysis of AI agent identity threats in MCP and token vaults

Context

AI agents are software entities that can take actions on behalf of users, connect to tools, and operate without a person approving every step. That changes the identity problem from one of static accounts to one of delegated, task-scoped authority that can expand as the agent's role expands.

MCP gives AI agents a standard way to reach external systems, while token vaults issue and manage the credentials that let those connections work. The governance gap is that most identity programmes still assume access is assigned to a stable principal whose scope can be reviewed after the fact.

For NHI governance, the important question is not whether these components enable integration, but whether they preserve control boundaries when the actor can initiate work, request tokens, and call tools dynamically across multiple systems.

Key questions

Q: What breaks when AI agents are governed like ordinary service principals?

A: The main failure is that ordinary service-principal governance assumes a stable workload with predictable lifecycle and entitlement patterns. AI agents can inherit access from a blueprint, act through user-shaped interfaces, and change their operational state at runtime, so the control model no longer matches the behaviour. Teams need a separate governance view for the agent runtime, not just for the underlying credential object.

Q: Why do token vaults still leave security risk in AI agent environments?

A: Token vaults reduce raw secret exposure, but they do not remove the need to decide who can mint tokens, under what context, and for which scope. If issuance policy is weak, the vault becomes a fast entitlement broker. The risk shifts from credential storage to credential governance, which is where most organisations are least mature.

Q: What are the signs that an AI agent may be running out of control?

A: Look for unusual consumption patterns rather than a single spike. Warning signs include token usage at the wrong hours, against the wrong model, or at a volume that does not match the task. A session that keeps consuming without useful progress, or that runs far longer than expected, often indicates a retry loop, orphaned agent, or compromised key.

Q: How should teams contain AI agent identity risk before a compromise spreads?

A: Teams should narrow task scope, shorten token lifetime, and separate high-trust actions from low-trust prompts so a single compromised agent cannot move freely across tools. The goal is to reduce identity blast radius before the agent touches sensitive workflows. Containment should be designed around action boundaries, not just around authentication events.

Technical breakdown

How MCP changes the identity boundary for AI agents

Model Context Protocol creates a standard communication layer between an AI agent and external tools, data sources, and APIs. In practice, that means the agent no longer talks to each system through one-off custom integrations, but through a protocol designed to carry context, authentication, and task intent. The security issue is that the protocol turns every tool call into an identity decision point. If the surrounding controls treat the agent like a static service account, they miss the fact that access can vary by task, context, and runtime behaviour.

Practical implication: Treat MCP connections as identity boundaries that need explicit policy, not as generic integration plumbing.

Why token vaults reduce exposure but do not remove trust assumptions

Token vaults abstract credentials so the agent never handles raw usernames, passwords, or API keys, and they can issue short-lived, scoped tokens on demand. That reduces direct secret exposure, but it does not answer who may request a token, when a token should be minted, or how broad the resulting access should be. The real control problem moves from secret storage to issuance governance. If the vault will grant access dynamically, then entitlement scope, revocation logic, and task context all become part of the security model.

Practical implication: Govern token issuance rules as tightly as you govern the protected systems those tokens can reach.

Where AI privilege creep emerges in task-driven automation

AI privilege creep happens when an agent starts with limited permissions and gradually accumulates more access as its role expands. Unlike a human role review, the expansion can occur through new tool bindings, additional scopes, or broader token grants that were added to keep the workflow working. Over time, the agent may end up with stale roles and over-provisioned access that no one re-evaluated against actual usage. The result is a growing gap between intended scope and effective scope, especially when the agent can act across DevOps, support, and data workflows.

Practical implication: Review agent entitlements against actual task scope, not against the broadest workflow the team can imagine.

NHI Mgmt Group analysis

MCP makes AI agent access governable only if the surrounding identity model keeps pace. A protocol standard can reduce integration chaos, but it does not make runtime authority predictable. The security mistake is to assume the agent is still behaving like a static application when it is actually selecting actions and reaching systems through contextual access paths. Practitioners should treat protocol standardisation as a governance opportunity, not proof of control.

Token vaults shift risk from secret possession to secret issuance. Abstracting credentials from the agent lowers the chance of raw secret leakage, but the harder question is who authorises each token minting event and what limits apply. If those decisions are loose, the vault becomes a high-speed entitlement broker instead of a control point. The practical conclusion is that issuance policy matters more than storage location.

AI privilege creep is the clearest example of NHI governance drifting out of alignment with actual use. An agent can begin with narrow access and accumulate broader rights simply because the business keeps adding tasks. That creates stale roles, over-provisioned tokens, and access that outlives the original use case. The practitioner lesson is that dynamic behaviour demands continuous scope review, not one-time provisioning logic.

Prompt injection is an identity issue because it redirects an agent's authorised action path. The payload does not need to break the perimeter if it can influence what the agent decides to do with already granted access. That makes the control problem less about message filtering alone and more about constraining what the agent can do once it has context and tool reach. Security teams need to think in terms of action authorization, not just input validation.

Identity blast radius is the right named concept for this category of risk. Once an AI agent can query systems, request tokens, and act across multiple tools, the impact of one compromised or mis-scoped identity expands well beyond a single application. The issue is not only privilege, but how far that privilege can travel across connected services. Practitioners should map agent identity blast radius before broadening any deployment.

From our research library:

• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: Agentic AI Identity Guide

What this signals

AI agent programmes should be designed as dynamic identity systems, not as an extension of application integration. The control question is whether the agent can request, combine, and spend authority in ways that were never fixed at provisioning time.

Identity blast radius: once an agent can reach multiple tools through a single identity path, one mis-scope can propagate across systems that would otherwise be separately governed. That makes scope containment the primary programme concern, not just secret storage.

The practical shift is toward authorisation at issuance time, with continuous review of where the agent is allowed to act and what data it can reach. Teams that keep reviewing the identity after the access decision will keep missing the moment the risk actually appears.

For practitioners

• Map agent task boundaries to explicit access scopes Define which tools, APIs, and data sources each AI agent may use for each task class, then tie those scopes to issuance policy rather than to the agent as a whole.
• Constrain token vault issuance rules Require short-lived, task-scoped tokens with revocation logic that reflects session context, not just identity presence, and deny token minting outside approved workflows.
• Review agent entitlements for privilege creep Reconcile current scopes against actual agent usage, especially where the same identity now reaches DevOps, support, and reporting systems that were not in the original design.
• Separate prompt trust from action trust Treat successful prompt interpretation as insufficient evidence of legitimacy and add policy checks before the agent can execute sensitive tool calls or retrieve sensitive data.

Key takeaways

• AI agents using MCP and token vaults introduce a governance problem where access can expand faster than traditional identity review cycles can track.
• The main risk is not only credential theft but also the gradual expansion of effective privilege across tools, systems, and workflows.
• Security teams should manage agent scope at issuance time and measure identity blast radius before broadening deployment.

Key terms

• AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Token Vaulting: Token vaulting stores sensitive credentials in a controlled system and releases them only when a workflow is authorised to use them. It reduces exposure in developer and automation environments by removing static secrets from endpoints, logs, and configuration files where malicious code often looks first.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• The vendor's breakdown of how MCP carries context-aware authentication across external tool calls
• More detail on token vault behaviour, including how short-lived tokens are issued, refreshed, and revoked
• The FAQ examples that translate AI agent identity risk into practical governance questions
• The source article's framing of prompt injection and token theft as identity security concerns

👉 Unosecur's full blog adds the MCP, token vault, and FAQ detail behind the identity risk discussion.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.