MCP compositional risk is creating silent AI execution paths

At a glance

What this is: Pynt’s research shows that MCP risk is driven less by any single plugin than by how untrusted inputs and privileged actions combine across 281 configurations.

Why it matters: IAM and AI security teams need to govern MCPs as execution pathways, because agent controls that assume isolated tools can miss chained privilege and input abuse.

By the numbers:

• 72% of MCPs allow sensitive operations such as writing to disk, executing code, or calling high-permission APIs.
• 13% of MCP plugins accept attacker-controlled inputs from sources like web scraping, Slack, or email.
• With three MCPs in a system, the chance of a silent exploit exceeds 50%.
• Installing 10 MCP plugins pushes the exploitation risk to 92%.

Context

MCPs, or Model Context Protocol connectors, sit between AI agents and the tools, APIs, or execution environments those agents can reach. The security problem is not simply whether one connector is safe, but whether multiple connectors together create a silent path from untrusted input to privileged action.

That matters to IAM and NHI practitioners because AI agents increasingly operate through delegated tool access rather than direct human oversight. When an agent can ingest messages, transform them, and trigger execution in the same chain, traditional approval and boundary controls can fail unless composition is governed explicitly.

Key questions

Q: What breaks when MCP plugins are combined without chain-aware controls?

A: The failure is not in any one plugin, but in the path between them. When untrusted input can flow from a scraping, messaging, or ingestion connector into a privileged execution connector, the agent can turn ordinary content into silent code or command execution without a human review step.

Q: Why do untrusted inputs become dangerous in MCP-based agents?

A: Because the same workflow that reads external content can also trigger privileged actions. If content from Slack, email, or HTML is passed into tools that can execute code or call high-permission APIs, the agent becomes a bridge from outside data to runtime action.

Q: What do security teams get wrong about MCP plugin risk?

A: Teams often treat plugins as if they were ordinary extensions, when in practice they can become trust-bearing execution components. If a plugin can influence tool output or run commands, it must be validated, scanned, and constrained before use. The mistake is assuming registry presence equals legitimacy.

Q: How should organisations govern approval for agent tool calls?

A: Approval should be reserved for actions that materially change state, reach privileged systems, or execute code. Teams should require contextual confirmation at the host level, then back it with execution isolation so a missed prompt does not become a full compromise.

Technical breakdown

Why MCP composition creates execution risk

MCPs are dangerous when they are treated like ordinary API integrations. A single connector may only ingest content, another may parse it, and a third may execute a command or call a privileged service. The risk emerges at the chain level, because trust boundaries disappear once untrusted input can flow into an execution-capable component without validation or approval. Static inspection of individual plugins misses that state transition, which is why the same setup can look benign in inventory but hostile at runtime.

Practical implication: Treat the MCP chain as the security unit, not the individual plugin.

How attacker-controlled input reaches privileged actions

The article’s examples show a recurring pattern: scraped HTML, Slack messages, and email content are accepted as if they were ordinary data, then passed into downstream tools that can write files, run code, or issue API calls. That creates an execution bridge from externally supplied content into trusted automation. In agentic environments, the agent does not need a human to confirm each step if the host, plugin, and tool chain are already configured to trust one another.

Practical implication: Validate and classify all inbound content before it enters an execution-capable MCP path.

Why approval checkpoints and runtime validation matter

MCP risk multiplies when systems lack approval checkpoints, isolation, and context-sensitive validation. Approval is not just a governance control, it is the point where a user can interrupt an unsafe chain before execution begins. Runtime validation is equally important because the same input may be harmless in one context and dangerous in another. Without these controls, the agent becomes an execution proxy that can turn a normal message into an unauthorised action.

Practical implication: Require contextual approval for high-risk tool calls and contain execution by default.

Threat narrative

Attacker objective: To use trusted agent workflows as a covert execution channel for code running, command execution, or privileged API abuse.

1. Entry occurs when an attacker delivers crafted Slack, email, or HTML content into an MCP-enabled agent workflow.
2. The content is processed by one connector and forwarded into another connector with privileged execution rights, bypassing human review.
3. The agent then executes code, shell commands, or other high-permission actions silently inside the connected environment.
4. The attacker gains covert execution through ordinary automation paths rather than through a visible exploit attempt.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP compositional risk is a governance failure before it is a technical flaw. The article shows that the decisive weakness is not any single plugin, but the absence of chain-aware control over how plugins combine. That matters because agent programmes often inventory tools, not executable paths, and the latter is where the risk actually lives. Practitioners should treat composition as the control boundary, not the connector catalog.

Silent execution paths are the real NHI problem in MCP environments. Once a connector can ingest untrusted input and another can execute privileged actions, the agent workflow has become an NHI governance issue, not just an API security issue. This is where identity, privilege, and runtime decision-making intersect. The named failure mode is silent execution path formation, and it should be tracked as a distinct control gap in AI programmes.

Approval checkpoints are necessary but insufficient without runtime isolation. The article’s examples show that human confirmation alone does not fix systems that permit uncontrolled tool chaining. If the host can freely pass content between connectors, the trust boundary has already failed before the approval prompt appears. Practitioners should regard isolation and context-sensitive validation as complementary controls, not optional hardening.

Agent sprawl now behaves like execution sprawl. The article’s risk curve shows how quickly exposure rises as more MCPs are added, which means governance debt grows with every new integration. The practical lesson is that agent onboarding must include execution-path review and offboarding must remove dormant connectors, otherwise the attack surface continues to expand after deployment.

Chain-aware validation should become the operating model for agent platforms. Traditional point checks were designed for APIs that expose functions, not MCPs that can trigger actions across multiple plugins. A secure programme needs visibility into how untrusted input travels, where privilege is introduced, and where execution occurs. That is now the control problem for agentic environments.

From our research library:

• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Chain-aware validation is now the practical control problem for agentic systems. Teams can no longer assume that safe individual connectors add up to a safe workflow. Once untrusted content can traverse several tools before execution, governance has to move from connector approval to path approval, and that changes how agent platforms are reviewed.

Agent onboarding should be treated like privilege onboarding. Every new MCP expands the set of possible execution paths, not just the catalog of integrations. That means security teams need an offboarding model for dormant connectors and a review model for every tool that can accept external content and emit privileged actions.

Silent execution paths are the new control gap in AI operations. The 2026 Infrastructure Identity Survey found that systems with least-privileged AI access had a 17% incident rate versus 76% for over-privileged systems, a reminder that scope and execution boundaries matter more than volume of tooling. For practitioners, the lesson is to govern where actions can happen, not just who can call the tool.

For practitioners

• Map every MCP chain end to end Document where untrusted content enters, where it is transformed, and which connector can trigger execution or privileged API calls.
• Require approval for high-risk tool calls Use host approval and contextual review for actions that write to disk, execute code, or invoke high-permission services.
• Isolate execution-capable connectors Separate parsers, scrapers, and execution tools so a single malicious input cannot traverse the full chain.
• Disable unused MCP servers and tools Keep only the servers and connectors actively needed for the current workflow and remove dormant integrations from the path.
• Test for chain-aware validation gaps Simulate crafted Slack, email, and HTML inputs to confirm whether runtime controls stop them before they reach execution.

Key takeaways

• MCP risk emerges when untrusted inputs and privileged execution tools are combined inside the same agent workflow, not when any single plugin is viewed in isolation.
• Pynt found that 72% of MCPs expose sensitive actions and 13% accept attacker-controlled inputs, which is enough to create silent execution paths at scale.
• The most effective control is chain-aware governance, backed by approval checkpoints, runtime validation, and isolation between ingestion, parsing, and execution tools.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Compositional Risk: The security risk that emerges from combining individually acceptable components into an unsafe end-to-end workflow. In MCP and agentic environments, the danger is often not a broken server but a delegation path that lets untrusted input influence privileged action.
• Silent Execution Path: An execution route that allows code or commands to run without a visible human decision at the point of action. In agentic systems, it usually forms when ingestion, parsing, and execution are linked without contextual checks.
• Chain-aware Validation: Validation that evaluates the whole path an input will travel, not just the first tool that receives it. It matters in agent platforms because risk is often introduced by the interaction between connectors, not by one connector alone.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps security and IAM teams build the control model that agent and workload access now requires.