Claude compliance API coverage exposes the limits of runtime agent security

At a glance

What this is: This is Straiker's analysis of Claude compliance API coverage, showing how runtime detection, session traceability, and policy enforcement are being applied to Claude Chat, Cowork, and Code.

Why it matters: It matters because practitioners need governance for agents that read untrusted content, call tools, and act across sessions, where traditional prompt-only controls and review workflows do not fully contain identity and access risk.

By the numbers:

• 98.1 to 99 percent accuracy, with a 0.02 percent false-positive rate and roughly 306 milliseconds of added latency.
• 75 percent of tested agentic applications were vulnerable to injection at the model layer.
• 36 percent of successful coding-agent attacks reached remote code execution on the developer's machine.
• 4,242 of the 17,651-plus MCP servers we track carry a known vulnerability.

👉 Read Straiker's analysis of Claude compliance API coverage and agent security

Context

Claude agent security is now a governance problem as much as a detection problem. Once agents read documents, invoke tools, and operate across Chat, Cowork, and Code, the relevant control plane shifts from simple prompt filtering to runtime authorisation, traceability, and review of external content that can carry hidden instructions.

For identity and access teams, the key question is who or what is allowed to act through an agent session, which tools it can reach, and how much evidence exists after the fact. That makes Claude-related controls relevant not only to AI security teams, but also to IAM, PAM, and non-human identity programmes that already manage delegated access and secrets exposure.

The article's starting position is typical of current agent deployments: capabilities expand faster than governance models catch up, especially where tools, Skills, and MCP servers are introduced without full lifecycle control.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do AI agents create new risk in non-human identity management?

A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts. They can connect quickly, persist across teams, and accumulate permissions that are hard to review. That combination increases the chance of unnoticed access drift and credential exposure.

Q: What breaks when Skills and MCP servers are approved without full inventory and review?

A: You lose visibility into the content and tools that can silently change agent behaviour. A Skill or MCP server can introduce hidden instructions, risky external calls, or data exposure without looking suspicious at the user prompt level. Without inventory and review, governance cannot prove which inputs were trusted and which were operationally active.

Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?

A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.

Technical breakdown

Runtime detection and inline blocking in Claude workflows

Runtime controls sit in the execution path, which is why they matter for agentic systems. Claude Code can expose execution-path hooks that stop a risky tool call before it fires, while other surfaces rely on detect-and-trace patterns that reconstruct the session after the fact. That distinction is important: prompt-time checks only see the conversation, but agents often act on content loaded from documents, Skills, or MCP servers. Once the agent chains a tool call, the control has to operate at the moment of decision, not after the response is generated.

Practical implication: place prevention where tool execution occurs, not only where prompts enter the model.

Skills, MCP servers, and indirect prompt injection

Indirect prompt injection is the core technical failure mode here. The malicious instruction does not need to appear in the user's prompt if it is hidden in a Skill, connector, README, or MCP response that the agent reads as trusted context. MCP, the Model Context Protocol, expands the set of tools and data sources an agent can reach, which also expands the attack surface for hidden instructions and data exposure. The security problem is not simply bad content, but unaudited trust in content that becomes operationally active the moment the agent loads it.

Practical implication: inventory every Skill and MCP endpoint as part of access governance, not as a separate content review exercise.

Traceability, telemetry, and evidence for agent actions

Traceability is what turns agent activity into something a SOC or auditor can reconstruct. OpenTelemetry, governed activity feeds, and full session replay let teams map which user, agent, tool, and data path were involved in a decision. That matters because agent incidents often look innocuous at each individual step. The browser call, file read, or tool invocation may be normal in isolation, but the sequence becomes malicious when the agent follows hidden instructions embedded in external content.

Practical implication: retain session-level evidence so investigations can connect a tool action back to the content path that triggered it.

Threat narrative

Attacker objective: The attacker aims to hijack an agent session so legitimate delegated access performs actions, data access, or external calls that the user never explicitly approved.

1. Entry occurs when a Claude agent loads a poisoned Skill, connector, document, or MCP response that contains hidden instructions.
2. Escalation follows when the agent trusts that content enough to invoke tools or reach external systems on the user's behalf.
3. Impact occurs when the agent exfiltrates data, reaches attacker-controlled infrastructure, or executes a risky action with valid delegated access.

NHI Mgmt Group analysis

Runtime agent security is becoming a control-plane issue, not just a model safety issue. Claude coverage across Chat, Cowork, and Code shows that agents now move through real enterprise workflows, which means the decision point is the tool call, not the chat turn. When a security control can block inline and trace sessions, it begins to look more like identity enforcement than content moderation. Practitioners should treat agent execution paths as governed access paths, not experimental AI features.

Indirect prompt injection creates a trust gap that conventional IAM does not close. IAM can answer who authenticated, but it cannot by itself prove whether the content an agent loaded was safe to act on. That is the verification trust gap: untrusted content gains operational authority once the agent loads it. For identity programmes, the implication is clear. Agent-scoped access, tool inventory, and policy enforcement must extend into the content sources that an AI system consumes.

Skills and MCP inventories are becoming part of NHI governance. The article's emphasis on scanners and runtime policy reflects a broader shift from static approval to continuous access governance for machine actors. In practice, Skills and MCP endpoints function like non-human dependencies with delegated authority, so they need lifecycle review, risk classification, and revocation logic. The practitioner conclusion is to govern these components with the same seriousness as service accounts and API keys.

Traceability will matter more than aspirational autonomy limits. The useful control is not whether an agent can do anything, but whether every action can be reconstructed with enough fidelity to answer who, what, and why after an incident. That aligns with OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework, especially where tool misuse and hidden instructions create audit friction. Teams should prioritise evidence quality alongside prevention.

What this signals

Verification trust gap: teams will need to govern not only what an agent is permitted to do, but what content it is permitted to trust. That means access reviews must expand from accounts and tokens to the Skills, connectors, and MCP sources that can alter behaviour, with references to the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework where appropriate.

The programme signal is that agent telemetry should become part of security operations and identity governance together. If session replay, tool lineage, and content provenance are missing, investigations will remain partial even when the agent itself was detected. That creates a practical case for aligning IAM, PAM, and NHI controls with AI runtime monitoring rather than treating them as separate workstreams.

For practitioners

• Inventory Claude-connected Skills and MCP endpoints Build and maintain a complete register of every Skill, connector, and MCP server an agent can reach. Classify each item by data exposure, tool reach, and trust boundary so access reviews cover the full execution path rather than only the user-facing app.
• Enforce runtime blocking for high-risk agent actions Use inline controls for tool calls that can move data, access browsers, or trigger external systems. Treat blockable execution points as the primary control for Claude Code and similar agent workflows, especially where delegated access can reach cloud keys or source code.
• Retain session-level evidence for investigations Preserve prompts, responses, tool calls, and the exact content path that influenced the agent decision. This gives SOC and GRC teams a defensible trail when a benign-looking action turns into exfiltration or unauthorized browser activity.
• Map agent controls to identity governance Align agent policies with IAM, PAM, and NHI processes so approvals, revocations, and exception handling follow a consistent governance model. That matters when the agent acts with delegated authority rather than a human typing every instruction.

Key takeaways

• Claude agent security now depends on runtime enforcement, because hidden instructions in Skills and MCP paths can turn trusted access into unauthorised action.
• The evidence base points to a governance gap, not an edge case, with most agent deployments already showing behaviour beyond intended scope.
• Practitioners should inventory agent-connected tools, block risky execution inline, and preserve session evidence so access decisions can be audited after the fact.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Identity Traceability: Identity traceability is the ability to link each action back to a specific identity, authorisation path, and time window. It is essential when humans, service accounts, and AI agents all operate in the same environment and auditors need a defensible record.
• Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.

What's in the full article

Straiker's full blog covers the operational detail this post intentionally leaves for the source:

• Runtime detection and inline blocking details for Claude Chat, Cowork, and Code deployments
• Session reconstruction examples showing how prompts, tools, and data paths are replayed for investigations
• Skills and MCP scanner logic for classifying indirect prompt injection and data exposure risk
• Framework mapping specifics for OWASP, NIST AI RMF, MITRE ATLAS, and EU AI Act alignment

👉 Straiker's full post covers the runtime controls, Skills and MCP scanning, and session tracing details.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and related lifecycle controls. It is built for practitioners who need to connect identity policy to real-world access risk across modern security programmes.