AI agent security platforms now govern MCP data movement and access

At a glance

What this is: Nightfall's analysis argues that AI agents are outpacing legacy DLP because MCP workflows and agent interactions create data movement paths those tools were not built to observe or control.

Why it matters: IAM and security teams need to treat AI agent authorization, tool access, and investigation workflows as a governed control plane, not as an extension of human data-loss controls.

By the numbers:

• The AI agents market is projected to grow from $7.1 billion in 2025 to $54.83 billion by 2032, representing a 33.91% CAGR across the 2026 to 2032 forecast period.
• Nightfall reports 95% precision with under 5% false positives, which it contrasts with the tuning burden often associated with legacy DLP.
• Nightfall says its AI-powered investigation delivers an 85% reduction in manual investigation time in its ROI model.

Context

AI agent security is now a data-governance problem as much as a detection problem. When agents can move information through MCP servers, IDE workflows, and SaaS applications at machine speed, controls built for human-driven exfiltration no longer give security teams reliable visibility or decision points. That creates a genuine identity and authorization gap, because the question is no longer only what data left the environment, but what the agent was allowed to access and through which tool path.

MCP makes that gap sharper because it standardises tool access between agents and external systems. Once those tool calls chain into SaaS, code, or document workflows, legacy DLP becomes a partial control at best. For practitioners, the relevant governance boundary is now the agent, its permissions, and the surfaces it can reach, not just the endpoint or email channel where data may eventually appear.

Key questions

Q: What breaks when AI agents can chain tools through MCP without tight policy controls?

A: What breaks is the separation between request, authorisation, and execution. A single agent session can move from one system to another, combine partial permissions, and create a wider blast radius than any individual entitlement suggests. Traditional access reviews miss this because they rarely model chained tool behaviour in real time.

Q: Why do AI agents create a different data security problem from standard user workflows?

A: AI agents can operate faster than human review, chain multiple tool calls, and move data across systems without a pause for approval. That means the control point must shift from after-the-fact monitoring to continuous enforcement, with identity, context, and destination all considered before data is released.

Q: How do security teams know whether an AI agent control stack is actually working?

A: Look for three things: every agent has a traceable identity, permissions are narrow enough to explain in operational terms, and actions can be audited end to end. If any of those are missing, the control stack is incomplete even if the data layer uses advanced privacy techniques. Identity, scope, and logging should all line up.

Q: How should organizations approach the governance of AI agents?

A: Organizations should adopt a governance framework that incorporates continuous visibility, adaptive IAM practices, and stringent policy-based controls. This ensures that all agent actions are tracked, authorized appropriately, and assessed for compliance.

Technical breakdown

Why MCP tool calls change the control boundary

MCP, or Model Context Protocol, gives agents a standard way to call tools and move data between models, apps, and external systems. That matters because the security decision is no longer limited to a network session or a file transfer. The agent can read, transform, and forward sensitive content through structured tool invocations that may never look like traditional exfiltration. In practice, the risk sits in the orchestration layer: prompts, tool responses, chained actions, and the permissions behind each step. Controls that only inspect destination channels miss the intermediate authority decisions that make the transfer possible.

Practical implication: Practitioners need policy enforcement at the tool layer, not only at the data egress layer.

Why AI agent authorization cannot mirror human IAM

Human IAM assumes a user logs in, works within a session, and can be reviewed after the fact. AI agents behave differently because they can call multiple tools, spawn chained actions, and process sensitive data at machine speed inside one task. That means access scope and action authorization must be evaluated per tool invocation and per agent identity, not just per user account. If the agent can read a repository, query a SaaS app, and forward the result without separate checks, then the effective privilege model is broader than the formal one. That is where governance fails: on delegated authority that was never bounded tightly enough.

Practical implication: Scope agent permissions by task, tool, and data class before letting the workflow run.

How autonomous investigation changes response economics

AI-driven investigation matters because agentic environments generate more alerts, more context, and more ambiguous chains of action than traditional DLP teams are used to handling. An analyst can no longer rely on a single file event or a single destination to explain the incident. They need attribution across prompts, tool invocations, policy hits, and downstream actions. Automation can reduce the manual work of assembling that picture, but only if the platform preserves a coherent audit trail. Without that evidence chain, response teams spend more time reconstructing intent than containing exposure.

Practical implication: Use investigation tooling that preserves prompt, tool, and response evidence across the full agent workflow.

Threat narrative

Attacker objective: The objective is to move sensitive data or credentials through trusted agent workflows while bypassing controls designed for human users.

1. Entry occurs when an AI agent is allowed to use MCP-connected tools and SaaS integrations as part of ordinary work.
2. Credential or data access is then expanded through delegated permissions that let the agent reach sensitive content at machine speed.
3. Impact follows when that content is moved, transformed, or exposed through workflows legacy DLP cannot reliably see or stop.

Breaches seen in the wild

• Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent governance is becoming a data-movement control problem, not just an application-security problem. The article shows that agents now traverse MCP servers, copilots, and SaaS tools in ways legacy DLP was not designed to interpret. That shifts the control question from blocking obvious leaks to governing the authority chain behind each agent action. Practitioners should treat agent data movement as a distinct governance surface.

MCP is creating a new form of trust boundary sprawl. Each tool call extends the agent's operational reach into systems that may have been governed separately under file, endpoint, SaaS, or code controls. That fragmentation makes it easy to miss how much authority an agent accumulates across one task. The named concept here is MCP governance gap: a mismatch between standardised tool access and controls that still assume human-paced workflows. Teams need to close that gap at the authorization layer.

Legacy DLP failure here is structural, not merely tactical. DLP tuned for human exfiltration can detect obvious movement, but agent workflows often package data inside prompts, responses, and chained tool actions. That means the platform problem is not only detection accuracy, but whether the control plane can reason over intent, tool class, and downstream action. Security teams should stop measuring success only by blocked transfers and start measuring whether agent authority is bounded in advance.

Security teams need a single policy model for human and machine activity. The article's core point is that separate controls for people and agents leave gaps in the middle, especially when an agent acts on behalf of a human in a SaaS workflow. That is where investigation, authorization, and response have to converge. Practitioners should align agent governance with identity-centric controls so the access decision and the data decision are made together.

The market is moving toward runtime control of autonomous workflows. Platforms are no longer competing only on data discovery or static posture; they are being judged on whether they can observe and stop agent actions as they happen. That signals a broader shift in the identity security market toward continuous authorization, auditability, and response for non-human actors. Practitioners should expect procurement to move from point controls to control-plane questions.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
• Read next: AI Agent Authorisation Guide

What this signals

MCP governance gap: security programmes now need to treat agent tool access as an explicit authorization surface, because data can be moved, transformed, and forwarded before conventional DLP ever sees a classic leak pattern.

The practical change is that teams should design controls around the agent's identity, the tools it can invoke, and the audit trail it leaves behind. That is the only way to make investigation and response viable when machine-speed workflows replace human-paced transfers.

An agent-centric control model will increasingly matter as adoption grows, because security teams cannot rely on policies built for browsers, inboxes, and file shares to govern autonomous tool use.

For practitioners

• Define agent authorization boundaries Map each AI agent to the exact tools, SaaS apps, and data classes it may touch, then deny everything else by default.
• Instrument MCP workflows for auditability Log prompt activity, tool calls, tool responses, and downstream actions together so investigations can reconstruct the full chain of agent behaviour.
• Separate agent data paths from human DLP assumptions Review whether existing DLP rules only understand email, browser, and endpoint movement, then extend policy to MCP and AI application surfaces.
• Tighten privileged access around machine identities Apply least privilege to service accounts, API tokens, and other machine credentials that agents use to reach sensitive systems.
• Test response workflows against agent-speed incidents Run tabletop scenarios where an agent moves data across multiple tools in one task so the team can practice containment and evidence collection.

Key takeaways

• AI agents create a governance gap when they move data through MCP servers and SaaS tools faster than legacy DLP can interpret.
• The security problem is less about a single blocked transfer and more about controlling agent identity, tool access, and auditability across chained actions.
• Practitioners need authorization, logging, and investigation controls that are built for machine-speed workflows rather than adapted from human data-loss models.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Agent Authorization: Agent authorization is the decision process that determines whether a software agent may take a specific action at runtime. It evaluates context, delegated authority, and resource sensitivity at the moment of execution, not only at login or provisioning time.
• Machine-Speed Data Movement: Information transfer carried out by AI agents, copilots, or automated workflows at a pace and volume that exceed human review cycles. It changes the control problem from spotting unusual strings to governing decision paths, permissions, and enforcement in real time.
• Agentic Workflow Trace: An agentic workflow trace is a record of the steps an AI agent took during a task, including prompts, retrievals, tool calls, and fallback decisions. It is essential for understanding how a system reached a response, especially when the workflow involves multiple services or policy gates.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners translate identity controls into operational policy for human and non-human access.