MCP bypasses legacy DLP and IAM because identity breaks

At a glance

What this is: Nightfall says MCP creates a structural blind spot for traditional DLP, IAM, and SIEM because agent activity can resemble normal API traffic while moving data through tool calls and semantic transforms.

Why it matters: IAM and security teams need to govern the agent boundary itself, because identity, context, and policy can disappear once data moves through MCP-connected tools and services.

Context

MCP is the protocol layer where AI agents connect to tools and data sources, and that layer now exposes a governance gap that legacy perimeter controls were never built to inspect. Traditional DLP, IAM, and SIEM assume data moves through bounded applications and stable user identities, but MCP turns both assumptions into weak signals rather than reliable control points.

The identity problem is especially important here because an agent can act through a service account or static key while the initiating human disappears from the access path. That makes MCP a genuine identity security issue, not only a data loss issue, because the control failure begins when identity no longer survives the agent boundary.

Key questions

Q: What breaks when MCP servers are connected without a trusted control plane?

A: Discovery and execution become the same decision, which removes the ability to review who published a tool, who can call it, and what trail exists after use. That creates a governance gap between the registry and the real runtime path. Enterprises usually discover the problem only after tool sprawl makes audit and revocation inconsistent.

Q: Why do MCP-connected agents increase risk even when traffic looks legitimate?

A: Because legitimacy at the transport layer does not mean legitimacy at the policy layer. An authenticated HTTPS call can still carry summarised or transformed sensitive data, and the receiving tool may not reveal who initiated the action or why it was allowed. Risk rises when the control plane cannot inspect intent, context, and downstream tool behaviour together.

Q: What are the signs that MCP governance is failing?

A: Common signs include agents reaching systems outside their intended workflow, incomplete audit trails for tool use, and data retrieval that cannot be tied back to a clear business purpose. If teams cannot reconstruct who invoked which tool, against which resource, and why, the MCP layer is already operating with insufficient control.

Q: How should teams govern MCP when it starts carrying long-running agent work?

A: Treat long-running MCP work as a governed execution state, not a simple API call. Security teams should define ownership, expiry, cancellation authority, and logging for each task so work cannot continue outside the intended policy boundary. That approach matters because the protocol is shifting from transient tool use toward durable agent operations.

Technical breakdown

Why MCP traffic looks like normal API activity

MCP supports both local and remote connections, so the same workflow may appear as a localhost process on an endpoint or as encrypted HTTPS traffic to a vendor domain. To a conventional DLP or network control, that looks like ordinary API usage rather than a distinct exfiltration channel. The practical difference is that the data path is embedded inside agent tooling, which means policy engines that rely on application fingerprints, port-based rules, or perimeter inspection miss the real movement of sensitive information.

Practical implication: discover MCP servers and agent endpoints before trying to classify their traffic.

How semantic transformation defeats content controls

Traditional DLP works best when the sensitive object keeps a stable lexical shape, such as a credit card number or a document type. MCP weakens that model because an agent can read sensitive content, summarise it, and re-express it in language that preserves meaning but not the original pattern. That means policy based on exact matches, regexes, or document classifiers loses coverage just when the data is most exposed. The issue is not only exfiltration, but transformation that removes the signal those tools depend on.

Practical implication: inspect prompts, tool outputs, and responses for meaning, not just known data patterns.

Why identity collapses at the agent boundary

In a typical MCP exchange, the human user is often represented indirectly while the server sees the agent or service account that executed the call. That breaks auditability because access review, SIEM correlation, and behavioural baselines are usually designed around human identities with stable sessions and traceable intent. Once the agent mediates the request, attribution can stop at the account used by the tool rather than the person who initiated the action. This is why identity that survives the agent boundary becomes a governance requirement, not a logging nicety.

Practical implication: bind every tool call to both the human initiator and the non-human identity that executed it.

Threat narrative

Attacker objective: The attacker wants to move sensitive enterprise data through trusted agent workflows without triggering the controls that normally watch file transfer, login, or API misuse.

1. Entry begins when an employee connects an MCP server through an IDE extension, desktop assistant, or custom agent platform that looks like ordinary authenticated API traffic.
2. Credential and context abuse follow when the agent uses a static key or service account and transforms sensitive source data into semantically equivalent output that no longer matches DLP fingerprints.
3. Impact occurs when sensitive information leaves through tool calls or approved integrations, bypassing the egress points that traditional controls are designed to monitor.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP creates a protocol-level governance gap, not just a new data-loss channel. The article shows that traditional controls fail because they inspect the wrong abstraction layer. DLP looks for known content, IAM assumes stable human attribution, and SIEM expects logs at application boundaries. MCP shifts all three assumptions into the agent layer, so the meaningful control point becomes the protocol itself. Practitioners should treat MCP as a new governance surface with its own discovery, inspection, and policy model.

Identity that does not survive the agent boundary is functionally incomplete. Nightfall's analysis is strongest where it shows that the user, the agent, and the tool can become different governance objects in the same action chain. That creates a new named concept: agent boundary identity loss, where attribution collapses from person to service account before policy can evaluate intent. The consequence is not only weaker auditability but a broken trust model for authorization. Practitioners should redesign identity binding so the initiating human remains traceable through every tool call.

Semantic exfiltration is the failure mode that legacy content controls cannot see. The article makes clear that an agent can repackage regulated or proprietary information without reproducing the exact strings that trigger a match. That means the problem is not merely encrypted transport or hidden files, but meaning-preserving transformation. In identity terms, this also changes NHI governance because the agent becomes the active policy actor while the human becomes indirect context. Practitioners should move detection toward content intent and tool-level policy enforcement.

Shadow AI now includes unmanaged MCP servers as much as unmanaged models. The article's inventory and exposure figures point to a governance problem that extends beyond sanctioned applications. If servers can be added with a single config line and still inherit enterprise credentials, then approval workflows and offboarding need to cover the server layer, not just the model layer. That widens the identity security perimeter to include lifecycle control for non-human connectors. Practitioners should inventory MCP connections as first-class assets.

Protocol-aware monitoring will matter more than perimeter observability for agentic environments. The article shows that useful evidence exists in prompts, tool calls, and responses, not only in network flows or SaaS logs. That means the future control stack has to correlate data classification, tool invocation, and identity context in one audit trail. The broader implication for the market is that agentic AI security is converging with NHI governance. Practitioners should expect security programs to shift from boundary monitoring to runtime control of agent workflows.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: MCP Security Guide

What this signals

Agent boundary identity loss: MCP exposes a control problem where the initiating human, the agent, and the tool no longer share a single auditable identity chain. That matters because every downstream decision depends on being able to attribute action to actor, and agentic workflows break that assumption first. Practitioners should redesign logging and policy so identity survives tool invocation instead of stopping at the service account.

The operational signal is that security teams will need to shift from perimeter DLP toward runtime governance that inspects tool calls, responses, and context together. NHI governance becomes part of the same control surface because the agent is now a non-human actor with its own lifecycle, permissions, and exposure risk. That makes protocol-aware monitoring a control objective, not a telemetry preference.

For practitioners

• Inventory every MCP connection Continuously discover MCP servers across desktop assistants, IDE plugins, and custom agent platforms, then remove any unapproved endpoint from the approved registry.
• Bind human identity to every tool call Log the human initiator, the non-human identity used by the agent, the tool invoked, and the returned data classification in one auditable record.
• Shift detection from patterns to meaning Inspect prompts, tool outputs, and responses for semantic leakage of sensitive data such as roadmaps, financials, customer records, and proprietary code.
• Enforce policy at the agent boundary Block or redact tool calls when the requested action exceeds classification rules, and reserve human review for high-risk actions that cross trust domains.
• Treat MCP servers as lifecycle-managed assets Apply onboarding, access review, and offboarding controls to each MCP server so deprecated connectors cannot retain enterprise access indefinitely.

Key takeaways

• MCP creates a governance gap because legacy DLP, IAM, and SIEM were built for stable user identities and predictable file movement, not agent-mediated tool calls.
• The core failure is attribution collapse plus semantic transformation, which means sensitive data can leave the environment without a recognizable pattern or a clean audit trail.
• Effective control shifts to discovery, protocol-level inspection, and policy enforcement that binds the human initiator to the non-human identity executing the action.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Agent Boundary: The point where external content, tool outputs, and environment data enter an agent's decision-making path. This is where validation, filtering, and authorization need to happen, because anything admitted at the boundary can shape the agent's next action and expand the attack surface.
• Semantic exfiltration: The leakage of sensitive information through meaning rather than through obvious data patterns. A prompt can request a client list, secret sauce, or internal policy in ways that evade simple scanners because the text does not contain the full sensitive payload. This is why context-aware review matters.
• Protocol-Aware Governance: A control approach that enforces policy where data actually moves, using protocol-level inspection, identity binding, and context-aware rules. It is necessary when traditional perimeter controls no longer understand the exchange format or the delegated actor involved in the transaction.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and workload identity for practitioners who need to control non-human access paths. It helps identity and security teams apply governance discipline to agentic systems, service accounts, and the controls that surround them.