AI agent security shifts from model risk to harness control

At a glance

What this is: This guide explains why AI agent security now centres on the harness, not just the model, because orchestrators, MCP servers, tool calls, and workflow telemetry define the practical attack surface.

Why it matters: IAM, PAM, and NHI teams need to treat agent access as an identity problem, because the question has shifted from who uses AI to what the AI can reach and do.

Context

AI agent security is the control problem that emerges when a model is connected to tools, data sources, and workflows that can act in an enterprise environment. Once that connection exists, the model itself is only one part of the risk surface; the harness around it determines what can be reached, what can be changed, and what data can flow.

For identity teams, the important shift is that agent risk is governed less by abstract model behaviour and more by permissions, tool scope, and workflow boundaries. That makes AI agents a governance problem for non-human identity, authorisation, and observability, with MCP adoption widening the number of systems that must be inventoryed and controlled.

The article frames this as a practical security transition: organisations are now discovering AI systems that can act on behalf of users, query enterprise data, and interact with business applications. That is typical of the current market direction, where control gaps increasingly sit in orchestration and access layers rather than in the model alone.

Key questions

Q: What breaks when AI agents are given broad enterprise access without tight governance?

A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene. The failure is not only misuse by an attacker. The system itself can exceed intended scope during normal task completion, so the real control problem is bounding authority before runtime action begins.

Q: Why do AI agents create access risk even when the model is accurate most of the time?

A: Because the risk is not only incorrect reasoning, it is incorrect action. A model that reads untrusted content and can act on it can turn a small mistake into an external email, database write, or escalation, which is why containment matters more than prediction quality.

Q: What are the signs that AI agent lifecycle controls are failing?

A: Common signals include undocumented agents, unclear ownership, persistent tokens, broad permissions that exceed task scope, and retired agents that still have live integrations. These indicators show that identity state is drifting away from governance and that offboarding is not closing access cleanly.

Q: How should teams govern AI agents that use MCP?

A: Treat each connected agent as a non-human identity with an owner, a scope, and a review cycle. The practical control set is familiar: least privilege, secret rotation, access expiration, and auditability across the systems the agent can reach.

Technical breakdown

Why the harness matters more than the model

An AI agent is not just a model that answers questions. It is a runtime that combines an orchestrator, tools, permissions, memory, and data sources into an execution environment. The model produces output, but the orchestrator decides when to call tools, the tool layer determines which systems are reachable, and the surrounding controls determine whether those actions are authorised. That means the security boundary is no longer the prompt alone. It is the full interaction path from instruction to tool use to returned data, especially where agents can write back into business systems.

Practical implication: inventory the orchestrator, connected tools, and permission scope before treating an agent as production-ready.

How MCP expands the attack surface for agents

MCP is a common interface between agents and external systems, which makes integration easier but also broadens the number of places where access can be abused. An MCP server can expose documents, databases, SaaS actions, or workflow steps to an agent, and that means the control problem becomes one of authorisation, trust, and content integrity at the connection point. If a tool response carries poisoned content or a tool itself is over-scoped, the agent can be steered into unintended actions without any model compromise. In practice, the protocol creates a standardised path into enterprise resources that must be governed like any other privileged interface.

Practical implication: treat MCP connections as governed access paths and review both tool trust and least-privilege scope.

Why tool responses are a security boundary

Tool responses are often overlooked because teams focus on prompts and initial user input. In agentic systems, however, the response from a database, website, knowledge base, or MCP server can contain instructions that alter agent behaviour, a pattern often described as indirect prompt injection. That makes retrieved content part of the security chain, not just the payload being consumed. If the agent trusts external content too broadly, the response layer can become a control bypass that leads to sensitive data exposure, tool misuse, or exfiltration through subsequent actions. The architectural lesson is that retrieval and execution cannot be treated as separate security domains.

Practical implication: apply content trust controls to retrieved data and inspect tool outputs before they influence action.

Threat narrative

Attacker objective: The objective is to manipulate an agent into revealing sensitive data or taking privileged actions through its connected harness rather than through the model itself.

1. Entry occurs when an agent is connected to enterprise tools, MCP servers, or content sources that it can query or act upon.
2. Credential or permission abuse follows when the agent is allowed broader tool access than its task requires, creating a path to unintended actions or data exposure.
3. Impact appears when the agent consumes poisoned content, misuses a connected tool, or sends sensitive data through a workflow it was permitted to reach.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent security is now a harness-control problem, not a model-safety problem: The model may still matter, but the practical boundary is the orchestrator, tools, permissions, telemetry, and data sources wrapped around it. That shifts the centre of gravity from jailbreak resistance to access governance, which is where enterprise security teams actually have leverage. The implication is that agent security programmes must be judged by what the harness can reach, not by how well the model refuses unsafe prompts.

Identity does not end at the user session when an agent can act on behalf of the user: Once an agent can query systems, send messages, or create tickets, the access relationship becomes a non-human identity problem. That means entitlement scope, tool trust, and execution logging matter as much as prompt hygiene. Practitioners should read this as confirmation that agentic risk belongs inside IAM, PAM, and NHI governance rather than in a separate AI-only silo.

AI agent access review assumes a stable permission state that agent workflows do not guarantee: Access review was designed for entitlements that persist long enough to be certified. That assumption weakens when an agent can enter, use, and combine tool access dynamically across a short workflow, especially through MCP-mediated integrations. The implication is that governance must shift from reviewing static access lists to governing the runtime path that creates access in the first place.

Prompt injection is only one expression of a broader trust-boundary failure: The article’s deeper point is that tools, descriptions, and retrieved content can all steer agent behaviour. That makes malicious or compromised context an execution risk, not just an input risk. For practitioners, the important concept is an identity blast radius, where one over-trusted integration can influence multiple downstream actions and data flows.

AI agents are becoming the next form of Shadow AI when discovery lags behind deployment: Security teams cannot protect what they have not inventoried, and agent ecosystems are already growing faster than many control frameworks. MCP adoption, reusable skills, and hidden workflow connections all increase the chance that an organisation will not know which agents exist or what they can do. The implication is that discovery and observability are now foundational controls, not optional maturity work.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Identity teams should treat MCP-enabled agents as governed access paths, not casual integrations: The control question is no longer whether a model can reason, but whether the connected runtime can reach the right systems with the right scope. That makes discovery, entitlement review, and telemetry the programme-level baseline for agentic AI.

AI agent security is converging with NHI governance faster than many security plans assume: The same issues that haunt service accounts and API keys appear again in agent workflows, but with a runtime that can choose tools and sequence actions. Teams that already govern machine identity are better positioned to extend those controls to agents without building a parallel AI security stack from scratch.

State of Secrets Sprawl 2026 shows 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption: that is a warning that integration convenience can outpace control design. The immediate programme question is whether MCP adoption is being paired with visibility, secret hygiene, and least-privilege review at the same speed as deployment.

For practitioners

• Inventory agent harness components Map every orchestrator, MCP server, tool, memory store, and data source connected to production agents so scope is visible before rollout.
• Constrain tool permissions to task scope Review each connected action surface and remove permissions that exceed the agent's intended workflow, especially write actions and broad read access.
• Inspect tool responses for injected instructions Treat retrieved content as untrusted input and add review or filtering before it can influence downstream agent behaviour.
• Centralise agent telemetry and audit logs Capture prompts, tool requests, tool responses, and execution events so security teams can reconstruct what an agent accessed and changed.
• Discover hidden AI activity paths Identify unsanctioned agents, skills, and workflow links across the environment before they become unmanaged access paths.

Key takeaways

• AI agents change security from model evaluation to runtime access governance, because the harness determines what enterprise systems the agent can reach and influence.
• MCP and similar integration layers expand the practical attack surface by giving agents standardised paths into tools, data sources, and workflows.
• Security teams need discovery, telemetry, and permission scoping to keep agentic systems within governance boundaries, because prompt controls alone do not contain runtime access.

Key terms

• AI Agent Harness: The control layer that surrounds a model and makes it operational in a real environment. It manages context, memory, tool use, and action gating, so the system can behave safely within policy and access constraints rather than acting on model output alone.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Tool Response: A tool response is the data an agent receives back from a connected system after making a request. It can be a benign result or a malicious instruction carrier, so teams must treat it as untrusted input that can influence agent decisions and downstream actions.
• Agent observability: Agent observability is the collection and correlation of traces, logs, metrics, and evaluations across an AI agent’s execution path. It explains what happened during model calls, tool use, handoffs, and downstream effects, but it does not itself authorize, deny, or revoke access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.