January 2026 showed AI security risk shifting into tools and MCP

At a glance

What this is: January 2026 AI incidents clustered around MCP exposure, prompt manipulation, and framework weaknesses, showing that toolchain and protocol failures are now central to AI security risk.

Why it matters: IAM, PAM, and AI security teams need to treat AI tool access, session control, and runtime authorisation as governance problems, not just application bugs, because the attack surface now includes the systems around the model.

Context

AI security risk is increasingly shaped by the tooling and control plane around models rather than by model behaviour alone. When agents, plugins, and protocols can invoke actions, read data, or move credentials, traditional application security boundaries blur and identity controls become part of the security perimeter.

This roundup focuses on incidents in January 2026 that affected AI systems, agents, tools, and protocols. The common thread is governance failure at the seams between authentication, authorization, prompt handling, and execution, which is typical of where AI security programmes are currently weakest.

Key questions

Q: What breaks when MCP services do not have guardrails?

A: Unauthenticated or weakly controlled MCP services turn the protocol into a direct path to tool abuse, credential exposure, and unauthorized execution. The failure is not only technical exposure, but loss of governance over what the agent is allowed to do once it reaches the control plane. That is why MCP needs explicit authentication, authorization, and runtime policy enforcement.

Q: Why does prompt injection become more dangerous once an AI system can use tools and credentials?

A: Tool use changes prompt injection from a text problem into an authority problem. A model that can only talk can cause bad output or leak instructions. An agent with read, write, or device-control permissions can exfiltrate data, publish content, or trigger physical actions. The same sentence now rides on borrowed authority, so impact depends on the capability exposed.

Q: How should security teams govern AI service credentials in production?

A: Security teams should govern AI service credentials as production identities, not disposable developer artifacts. That means assigning owners, setting expiry, limiting scope to the minimum required service, and tracking where each credential is stored and used. The key control is lifecycle discipline, because most exposure comes from credentials that remain valid long after the original task is finished.

Q: What is the difference between prompt filtering and runtime authorization for AI systems?

A: Prompt filtering tries to stop harmful content from reaching the model, while runtime authorization decides whether an action should be allowed at all. They solve different problems. A system can pass a content filter and still be unsafe if the agent can call tools, read data, or execute actions beyond its intended scope.

Technical breakdown

MCP endpoints and control paths as an attack surface

Model Context Protocol connects AI agents to tools, repositories, and automation services, which makes its endpoints and control paths security-critical. If an MCP service is exposed without strong authentication and authorization, an attacker can move from request submission to tool abuse without needing to compromise the underlying model. In practical terms, the protocol becomes the policy boundary. That means the real risk is not only what the model says, but what connected tools are allowed to do when the agent invokes them.

Practical implication: treat MCP services like privileged integration points and enforce explicit access control, inventory, and runtime inspection.

Prompt manipulation as a session and delegation problem

Prompt injection is often described as a content problem, but these incidents show it behaving more like a delegation problem. When prompt parameters, URL inputs, or external content can alter an agent’s execution path, the attacker is not just changing text. They are steering tool invocation, session state, or downstream data access. That is why prompt manipulation becomes dangerous when it is coupled with session continuity, cached context, or tool permissions that persist beyond a single user action.

Practical implication: bind prompt inputs to strict trust boundaries and separate user content from agent instructions at the control layer.

Why AI incidents now look like identity and access failures

Many of the January incidents were enabled by familiar control gaps: unauthenticated endpoints, over-broad access, unsafe rendering, and weak control over credentials and tokens. In AI environments, those gaps are amplified because agents act quickly, across systems, and with delegated authority. The important shift is that AI security is no longer just a model integrity issue. It now overlaps with identity governance for service accounts, API keys, and machine-to-machine permissions, which means access scope and runtime authorisation are central to containment.

Practical implication: govern AI systems through the same identity, privilege, and secrets controls used for other high-risk non-human identities.

Threat narrative

Attacker objective: The attacker aims to take control of AI-enabled workflows, steal credentials or data, and use delegated trust to expand access across connected systems.

1. Entry began through exposed or weakly protected AI tooling such as MCP endpoints, bot previews, or prompt-influenced interfaces.
2. Credential harvesting and control abuse followed when those interfaces exposed tokens, API keys, or agent actions that could be redirected by an attacker.
3. Escalation occurred as the attacker used delegated access to hijack sessions, access data, or trigger unauthorized code execution across connected services.
4. Impact included credential leakage, unauthorized actions, data exfiltration, and in some cases execution risk across the AI workflow.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Microsoft SAS token exposure 2023: An over-permissive Azure SAS token in a Microsoft AI GitHub repo exposed 38TB, including workstation backups and Teams messages, for 3 years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP has moved from integration detail to governance boundary. The January incidents show that Model Context Protocol services can expose the same kind of control-plane risk that once lived in privileged APIs and admin consoles. When unauthenticated endpoints can drive tools, fetch repositories, or trigger actions, MCP becomes a place where identity, authorization, and runtime policy must be enforced together. Practitioners should treat MCP governance as a first-class control domain, not an implementation afterthought.

Prompt injection matters most when it becomes action injection. The security problem is no longer just malicious text in a prompt. The real issue is that manipulated inputs can redirect agent behaviour, influence session state, and steer tool use. That is a governance failure around delegation, not merely content filtering. The practical conclusion is that AI systems need hard separation between user-supplied content and agent instruction channels, with explicit policy checks before action execution.

January’s incidents expose a new form of control-plane sprawl. The recurring pattern is not model failure but weak access control around adjacent systems: previews, renderers, repositories, and protocol gateways. This is the AI equivalent of unmanaged privilege sprawl in identity programmes. The industry now needs to think in terms of AI toolchain trust gap, where the weakest connected component becomes the security boundary. Practitioners should map every tool, token, and delegation path before scaling agent workflows.

Non-human identity governance is now part of AI security governance. Agents, bot services, and protocol connectors depend on service credentials, scoped tokens, and delegated permissions that behave like NHIs even when the article does not use that language. Once those identities are allowed to act across systems, the governance question becomes who issued the authority, what it can reach, and how it is revoked. Practitioners should fold AI systems into their NHI inventory, privilege review, and secrets lifecycle controls.

From our research library:

• Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.

What this signals

AI toolchain trust gap: January’s incidents show that the main security boundary has shifted to the systems surrounding the model, including MCP gateways, renderers, previews, and workflow connectors. That means AI security programmes need to measure trust at the point of delegation, not only at the point of model output.

The immediate programme implication is that teams should fold agent integrations into their identity, secrets, and privilege governance models. If an AI system can act across repositories, tickets, code, or customer data, then its credentials, permissions, and revocation process should be governed like any other high-risk NHI estate.

For practitioners

• Map every MCP endpoint and agent integration Inventory each protocol gateway, tool connector, and automation service that can accept agent requests, then classify the access it can trigger, read, or delegate.
• Separate prompt content from execution authority Design the control plane so that user input can influence answers without being able to change the permissions, session scope, or tool set available to the agent.
• Constrain AI service credentials to the minimum needed Treat API keys, tokens, and bot credentials as non-human identities with explicit ownership, scoped permissions, and revocation paths tied to the workflow.
• Add runtime inspection to high-risk AI workflows Log and review tool calls, outbound requests, and privilege changes so that unexpected agent behaviour can be detected before it spreads across connected systems.

Key takeaways

• January 2026 incidents show that AI security failures are now concentrated in toolchains, protocols, and delegated workflows rather than in the model alone.
• The recurring weaknesses were authentication, authorization, prompt manipulation, and runtime control across MCP services, bot previews, and framework integrations.
• Teams should govern AI systems as identity-bearing components, with explicit control over credentials, permissions, and action boundaries.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Agent Delegation Chain: A delegation chain is the sequence of agents that pass tasks, context, or actions to one another before work is completed. In governed systems, each hop becomes a security boundary because identity, authority, and accountability can change as the task moves downstream.
• Control plane exposure: A condition where the interface used to configure, direct, or invoke a system becomes reachable beyond its intended boundary. For non-human identities and agents, exposed control planes can turn a local helper into an externally reachable privileged service.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity teams apply the same discipline to AI-enabled workflows and delegated access.