AI agent security needs runtime control, not visibility alone

At a glance

What this is: Nightfall argues that AI agent and MCP environments create data movement and control gaps that visibility-only approaches cannot close.

Why it matters: This matters because IAM, PAM, and data security teams need controls that govern agent actions at runtime, not just detect them after the fact.

By the numbers:

• 95% precision out of the box is the figure Nightfall cites for its detection engine compared with legacy DLP baselines of 5-25%.
• Nightfall says organizations report 90% reduction in false positives in data exfiltration prevention compared to legacy DLP solutions.
• Nightfall says organizations achieve 20x average ROI with 6x ROI achievable within 90 days.

Context

AI agent security is the control problem that appears when software can decide which tools to use, which data to request, and when to act. In this article, the gap is not simple visibility into agent activity, but the lack of runtime controls that can stop risky tool calls, redact sensitive content, or quarantine actions before data leaves governed boundaries.

MCP adds a second layer of exposure because it connects agents to external tools, local resources, and enterprise workflows. That creates a governance problem for identity, privilege, and data movement at the same time, which is why legacy DLP and point visibility tools often underperform once agents start using real enterprise access paths.

Key questions

Q: What fails when AI agents are monitored but not controlled at runtime?

A: Visibility alone fails because it only shows the unsafe action after the model has already interpreted the prompt and chosen a tool path. Runtime control is different because it can stop the call, redact the data, or quarantine the action before sensitive information leaves the governed workflow. That is the control boundary that matters for agent security.

Q: Why do AI agents and MCP-connected workflows create new data exposure risks?

A: AI agents and MCP-connected workflows expand access beyond human users into systems that can retrieve, transform, and move sensitive data automatically. That increases the chance of uncontrolled sharing, especially when agents can reach code repositories, tickets, cloud storage, and internal knowledge bases. Security teams need policy enforcement, access visibility, and content inspection around every agent action.

Q: What are the signs that agent security controls are lagging?

A: Common signs include agents appearing in production without clear ownership, unclear visibility into tool calls, and no reliable way to reconstruct what a session changed. If the security team cannot answer who authorised the agent, what it touched, and what it delegated, the control model is already behind the workflow.

Q: How should security teams govern AI agents before they start blocking actions?

A: They should begin with observation-only controls, capture action-level telemetry, and build a baseline of normal behaviour before enforcing deny rules. That sequence reduces false positives and prevents policy from being written against assumptions instead of evidence. Once the baseline is stable, teams can harden policy around observed workflows rather than generic templates.

Technical breakdown

Why MCP changes the control plane for AI agents

Model Context Protocol gives AI applications a structured way to call tools, query data sources, and interact with workflows. The security change is not the protocol itself, but the fact that tool use becomes dynamic and context-driven rather than fixed at build time. That means a security team can no longer assume that monitoring the app or the endpoint is enough. The control point shifts to the runtime conversation between model, tool, and output, where sensitive data may be requested, transformed, or forwarded in ways that legacy controls do not inspect deeply enough.

Practical implication: treat MCP as a governed execution surface and not just an integration layer.

Why visibility alone misses prompt injection risk

Prompt injection works by shaping the inputs an agent trusts, so the model follows attacker-supplied instructions instead of the intended policy. In practice, that can cause data leakage, unauthorized actions, or policy bypass inside a trusted session. Visibility tools may record the event, but they do not stop the unsafe tool call or response path once the injection has taken effect. Effective defence requires inline controls that can inspect context, compare intent, and block or redact output before the agent completes the action chain.

Practical implication: place enforcement where the agent decides, not where analysts review the logs.

How unified data control differs from legacy DLP

Legacy DLP was built mainly around human-paced data movement, such as copying files, sending email, or uploading documents. AI agent workflows move data across SaaS, endpoints, browsers, email, and tool calls in a single task, often without a clear user action at each step. A unified control layer can apply the same policy to human and machine movement, which matters because the identity carrying the action may be a person in one moment and an AI agent in the next. That identity crossover is the real governance challenge.

Practical implication: govern human and non-human data movement under one policy model where possible.

Threat narrative

Attacker objective: The objective is to use the agent’s own trusted access path to move sensitive data or trigger actions without normal user approval.

1. Entry occurs when an AI agent is connected to enterprise data and tools through MCP or a similar integration path.
2. Credential or context abuse follows when malicious prompts manipulate the agent into trusting attacker-influenced instructions and tool responses.
3. Impact occurs when the agent leaks sensitive data, executes unauthorized actions, or weakens intended controls inside the workflow.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime control is now the real security boundary for AI agents. Once an agent can choose tools and act inside live workflows, post-event visibility becomes a forensic aid rather than a control. The article reflects a broader shift in which agent governance has to happen at the moment of execution, especially when the same workflow can carry both human and non-human identities. Practitioners should treat enforcement at runtime as the primary decision point, not a monitoring add-on.

Prompt injection exposes an intent gap, not just a content-filtering gap. The problem is that the agent may execute a malicious instruction while still appearing to operate within its expected surface area. That means the control failure sits between detected content and trusted action, which is why AI governance frameworks need to account for instruction trust, tool authority, and output handling together. Security teams should design for decision integrity, not only data inspection.

AI agent identity creates a governance problem that traditional IAM does not fully resolve. An agent can inherit access from a human workflow, then use it in ways the original approval never described. That makes access scope, session context, and tool permissioning central to agent governance, especially where MCP expands the number of reachable systems. The practitioner takeaway is to govern agent authority as a distinct identity model, not as a proxy for the end user.

AI agent security will increasingly converge with data security and privilege governance. The article shows that the practical distinction between “security tooling” and “identity tooling” is fading when agents can read, transform, and send data through enterprise controls. That convergence means IAM, PAM, and DLP teams need shared policy semantics for runtime action, data exposure, and delegated access. Practitioners should plan for cross-domain governance rather than isolated tool ownership.

Runtime enforcement is becoming the named concept that separates mature from immature agent governance. Visibility can tell you what happened, but runtime enforcement decides whether the action is allowed to happen at all. That distinction will matter more as MCP adoption expands and AI agents become normal participants in business workflows. Security leaders should use that shift to reset expectations for control design and operating model ownership.

From our research library:

• Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
• Read next: AI Agent Authorisation Guide

What this signals

Agent privilege is now a measurable risk factor, not a theoretical one. According to the 2026 Infrastructure Identity Survey, 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, and 19% grant dramatically more access. That gap is why runtime policy has to be tied to delegated authority, not just to monitoring or review.

Over-privileged agent workflows correlate with materially worse outcomes. Systems with least-privileged AI access had a 17% incident rate versus 76% for over-privileged systems, and organisations failing to scope AI access properly are 4.5x more likely to experience a security incident. For practitioners, the signal is clear: access scope is now an operational control, not a documentation exercise.

Runtime enforcement is the practical answer to agent sprawl. As AI tools and MCP workflows multiply, the governance gap is no longer whether teams can see an action but whether they can stop it in time. Practitioner programmes should plan for agent authority, tool scoping, and data movement policy as one control surface, not three disconnected projects.

For practitioners

• Implement runtime enforcement for agent tool calls Block, redact, or quarantine sensitive MCP prompts, tool responses, and shell commands before the agent completes the action chain.
• Separate agent authority from user authority Define explicit permission boundaries for AI agents so delegated access does not inherit the full scope of the human session that initiated it.
• Apply policy to data movement across every surface Use one control model across SaaS, browser, endpoint, email, and AI workflows so humans and agents are governed consistently.
• Test prompt injection against real tool paths Exercise the exact integrations an agent uses in production, including tool calls and model responses, to confirm whether unsafe instructions are actually blocked.
• Measure false positives and response latency Track how often controls misclassify normal work and how quickly they can block or redact risky actions, because delayed enforcement leaves exposure windows open.

Key takeaways

• AI agents and MCP integrations create a runtime governance problem because tool use, data movement, and action timing happen inside live sessions.
• Nightfall says visibility gaps persist when traditional DLP is applied to agent workflows, especially where prompt injection can steer tool calls or exfiltrate data.
• Security teams need enforcement that can block, redact, or quarantine actions before sensitive information leaves the controlled workflow.

Key terms

• MCP Security: MCP security is the set of controls that protect Model Context Protocol connections between agents, tools, and data sources. It covers connector permissions, secret handling, and policy enforcement because the protocol can become a direct path from agent intent to enterprise action.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Delegated Agent Authority: The permission granted to an AI agent to act on behalf of a human user or another agent, inheriting some or all of their access rights. Delegated authority must be explicitly scoped, time-limited, and auditable.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security programme they run every day.