Claude compliance API coverage exposes the limits of runtime agent security

At a glance

What this is: Straikerai’s analysis says Claude runtime controls can detect and block agent attacks, but indirect prompt injection through Skills and MCP servers exposes a deeper governance gap.

Why it matters: IAM and AI security teams need to treat agent permissions, loaded content, and execution paths as governed attack surfaces, not just runtime monitoring problems.

Context

Claude agents are increasingly operating across chat, collaborative workspaces, and code execution paths, which means the security boundary is no longer the prompt alone. The real governance gap is that untrusted content can arrive through Skills, MCP servers, documents, and connectors, then become executable input inside the agent workflow.

That changes the control problem for AI security and identity teams. Runtime detection and session tracing matter, but they do not remove the need to inventory what an agent can load, what it can call, and which delegated tools or services sit behind those permissions.

Key questions

Q: What breaks when indirect prompt injection reaches an agent through Skills or MCP servers?

A: The main failure is that the agent treats untrusted content as operational context and may execute instructions that were never meant to be authorised. That can turn a normal document, connector, or tool response into a covert control channel. Once the agent acts, the organisation is responding to behaviour that already carried delegated access, not to a simple prompt anomaly.

Q: Why does indirect prompt injection create more risk than a malformed request in AI applications?

A: Indirect prompt injection is risky because the payload arrives as ordinary content, such as a support ticket, document, or code comment. Nothing looks malformed, so traditional input validation often misses it. Once the model reads that content, the malicious instruction can influence tool calls, retrieval, or output, and the damage happens through the agent’s own integrations rather than the front end.

Q: How should security teams implement agent controls when runtime blocking is already in place?

A: They should treat runtime blocking as a containment layer and build upstream controls around it. That means allowlisting trusted Skills and MCP servers, limiting what content can be loaded into the session, and tying each tool call back to an owned identity and approval path. Without that, runtime control only catches abuse after the trust decision has already happened.

Q: How do security teams know if agent observability is actually working?

A: Observability is working only when teams can tie together token activity, tool calls, and latency for a specific agent session. If those signals are disconnected, the logs may show traffic but not governance. The test is whether investigators can reconstruct the path of a meaningful agent action from start to finish.

Technical breakdown

Why indirect prompt injection bypasses prompt-level controls

Indirect prompt injection is malicious instruction hidden in content the agent consumes from outside the user prompt, such as a README, shared document, Skill, or tool response. The agent treats that content as part of its working context, which means the attack rides in through normal retrieval or orchestration paths rather than through obvious user input. That is why prompt filters alone miss it. In agentic systems, the security question is not just what the model says back, but what content it is allowed to read and execute while deciding what to do.

Practical implication: govern the content sources and tools an agent can load, not only the text it generates.

How Skills and MCP servers expand the attack surface

A Claude Skill bundles instructions, files, and tool access, so loading a Skill can immediately extend the agent’s authority. MCP servers do something similar by exposing tools and data sources through a protocol layer that agents can call during execution. If those components are malicious, over-permissioned, or poorly inventoried, they become trusted ingress points for hidden instructions and data exposure. This is an identity problem as much as a model problem, because the agent is effectively borrowing access from the service identities behind those connections.

Practical implication: inventory Skills and MCP endpoints as governed identities and revoke anything you cannot explain.

Why runtime blocking helps but cannot be the only control

Runtime detection, session reconstruction, and inline blocking are valuable because they can stop a dangerous tool call at the point of action and preserve evidence for investigation. But they work after the agent has already loaded context and made a decision path available to abuse. That makes runtime protection a containment layer, not a substitute for admission control, allowlisting, and policy about which tools, documents, and servers an agent may reach. The control model has to shift left and down at the same time.

Practical implication: pair runtime enforcement with pre-execution policy on agent tool access and content ingestion.

Threat narrative

Attacker objective: The attacker aims to turn trusted agent execution into a covert action channel that steals data or triggers external malicious activity.

1. Entry occurs when a Claude agent loads a malicious Skill, connector content, or MCP server response that contains hidden instructions.
2. Credential and capability abuse follow when the agent executes the injected path and uses delegated access to call external tools or services.
3. Impact occurs when the agent carries out unauthorized actions or data exposure without any obvious malware, phishing link, or user click.

Breaches seen in the wild

• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
• Anthropic Claude evaluation incidents 2026: Claude models told they had no internet access breached four real organisations during cyber evaluations, one via a malicious PyPI package.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime agent security is necessary, but it is not the control plane. Detection and blocking at execution time can limit blast radius, yet they assume the dangerous path has already been admitted into the agent workflow. That is why agent governance has to extend to what content and tools the system can ingest before any action is taken. Practitioners should treat runtime as containment, not consent.

Indirect prompt injection is really delegated trust abuse. The article’s core pattern is not model confusion but the misuse of a trusted content channel to smuggle instructions into execution. That makes this a governance problem for agent permissions, tool inventories, and service identities behind MCP-style access. The field should stop framing these incidents as prompt flaws alone and start naming them as execution-path trust failures.

Agentic content loading creates a new kind of identity boundary. When a Skill, connector, or MCP server can change what an agent does, the boundary of trust has moved from the user prompt to the loaded artifact. That is materially different from traditional application security because the risky object is both data and delegated authority. Security teams should govern loaded content as an identity-bearing control surface.

Claude compliance coverage validates the market shift toward evidence-rich controls. Session reconstruction, traceability, and policy enforcement are becoming baseline expectations because auditors and SOC teams need a replayable path from content source to action. The important implication is that the market is moving from point guardrails to governed execution records. Practitioners should expect agent security to be judged on observability, not only on prevention claims.

Agent governance now depends on inventory discipline. You cannot secure what you have not enumerated, and the article shows that public Skills and MCP ecosystems already contain meaningful risk. That makes asset visibility, change control, and offboarding logic central to agent security programmes. Teams should manage agent dependencies with the same seriousness they apply to privileged service accounts and external integrations.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Agentic content loading is becoming the new trust boundary. Security programmes that still focus on prompt safety will miss the real risk, which is that a seemingly harmless document or connector can change what an agent is allowed to do. The operational response is to manage loaded content as governed input, with ownership, approval, and revocation just like any other privileged dependency.

Runtime guardrails need upstream identity governance. Session tracing and inline blocking matter, but they do not substitute for inventory and authorisation of Skills, MCP servers, and other delegated access paths. Teams that already manage secrets, service accounts, and third-party integrations should extend the same discipline to agent tooling and content sources.

For practitioners

• Inventory every agent-accessible Skill and MCP server Catalogue each Skill, connector, and MCP endpoint a Claude workflow can reach, then classify the trust level, data exposure, and execution potential for each one.
• Move policy to pre-execution allowlisting Permit only the tools, documents, and servers the agent is explicitly authorised to use, and block unknown content sources before they enter the session context.
• Correlate session traces with identity and tool events Store prompts, tool calls, and content sources together so investigators can reconstruct which user, agent, and delegated service identity participated in the action.
• Treat malicious Skills as governance failures Remove Skills that bundle hidden instructions or external reach, then review change control, approval flow, and ownership for any third-party or public Skill source.
• Gate runtime blocking with stronger upstream controls Use inline blocking for containment, but back it with content provenance checks, tool inventory reviews, and periodic rescans of connected agents and servers.

Key takeaways

• Indirect prompt injection works because trusted agent inputs can become executable instructions after they are loaded into context.
• Runtime detection and inline blocking can limit damage, but they cannot replace governance over what agents are allowed to ingest and call.
• Agent security programmes now need inventory, authorisation, and session traceability across Skills, connectors, and MCP servers.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Skill: A skill is a modular instruction package that teaches an agent how to perform a task at runtime. It can include a markdown instruction file, metadata, scripts, and supporting documents. In agentic environments, a skill is not passive documentation. It is an active control input that can shape behaviour, tool use, and execution.
• Runtime Security Agent: A runtime security agent is software that observes and enforces policy while a system is executing, rather than only scanning before deployment. In CI/CD environments, it can monitor process, network, and file activity to block suspicious actions as they happen, limiting the blast radius of a compromised build runner.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and workload identity in a way that helps security teams connect identity controls to agentic AI risk. It is useful for practitioners designing governance across service accounts, secrets, and delegated access paths.