TL;DR: MCP vulnerabilities can let attackers inject prompts, overwrite memory, inflate context windows, and hijack agent-to-agent transfers, creating unauthorized API access and corrupted decisions in AI-native workflows, according to Akto. The governance problem is that agent memory is treated as trustworthy state even when its provenance, persistence, and transfer rules remain weak.
At a glance
What this is: Akto examines how MCP weaknesses let attackers manipulate agent memory, context flow, and decision chains in AI-native systems.
Why it matters: This matters because identity and access decisions increasingly depend on machine-held context, so weak memory governance can become an authorization failure path for autonomous and agentic AI workflows.
Context
Model Context Protocol is becoming a control plane for how autonomous agents carry state across tasks, but that also means memory is no longer just an internal implementation detail. Once prompts, intermediate state, and transfer history influence decisions, the security problem shifts from ordinary input validation to governing provenance, persistence, and trust in context itself. That creates a direct identity and access concern when agent state can drive API use or delegated actions.
The core governance gap is that many teams still treat context as if it were inherently trustworthy because it arrived through the agent workflow. In practice, MCP turns memory into operational state that can be poisoned, overwritten, inflated, or transferred between agents. For IAM, PAM, and NHI programmes, that means the control boundary now has to cover what the agent remembers, not just who or what initiates the session.
Key questions
Q: What breaks when MCP context is not provenance-checked?
A: When MCP context lacks provenance checks, agents can treat injected or overwritten memory as trusted state and carry that corruption into later decisions. The failure is not just bad input handling. It is a broken trust chain that lets manipulated context drive API calls, routing, scoring, or other privileged actions.
Q: Why do unverified context transfers create risk in agentic AI systems?
A: Unverified transfers let one agent inherit context from a source it cannot truly authenticate, so a spoofed or compromised handoff can become a delegated trust decision. That matters because the receiving agent may use the transferred memory for approvals, tool use, or downstream automation without knowing it was tampered with.
Q: How do security teams detect context inflation or shadow memory abuse?
A: Teams should watch for unusual growth in memory size, entry count, and update frequency, then compare context snapshots at checkpoints to spot hidden additions or overwrites. The strongest signal is a mismatch between what the agent appears to know and what normal audit logs can actually explain.
Q: Who is accountable when agent memory causes an unauthorised action?
A: Accountability should sit with the programme that owns the agent’s authority, data access, and runtime controls. For regulated environments, that means mapping ownership to IAM, AI governance, and audit functions, then proving that context provenance, transfer rules, and retention controls were enforced.
Technical breakdown
How MCP turns memory into executable state
MCP structures prompts, intermediate outputs, API history, and execution metadata as runtime context that agents reuse across steps. That is useful for multi-step reasoning, but it also means memory is not passive storage. If the protocol does not enforce provenance and integrity, the agent can act on state that looks legitimate but was altered upstream. In practical terms, the attack surface is the transition from one context state to the next, where poisoned memory becomes the basis for a future decision or API call.
Practical implication: Treat agent context as a governed control surface, not as benign application state.
Why context inflation and shadow memory break validation
Context inflation works by filling the memory window with redundant or recursive material until important tokens, checks, or headers are pushed out of view. Shadow memory is harder to detect because the malicious state persists outside ordinary audit trails while still shaping decisions. Both patterns exploit the fact that many validation layers assume the full relevant context remains visible and intact. When that assumption fails, an agent can skip approvals, misread task state, or execute with incomplete or distorted evidence.
Practical implication: Monitor context size, provenance, and visibility together, because any one signal alone is not enough.
How unverified agent-to-agent transfers spread compromise
In collaborative systems, one agent often hands off memory to another so work can continue without re-planning. Without strong source authentication, that transfer becomes a trust bridge an attacker can exploit by spoofing the origin or modifying the payload. The result is not just a local error. A bad context object can move downstream and corrupt multiple agents, multiplying the effect of a single compromise. This is especially dangerous when transferred memory influences approvals, routing, scoring, or tool invocation.
Practical implication: Require authenticated context transfer rules before agents are allowed to inherit state from peers.
Threat narrative
Attacker objective: The attacker wants to steer agent behaviour, force unsafe API actions, and turn trusted context into an unauthorised control path.
- Entry occurs when an attacker injects malicious prompts or manipulates a context update path in an MCP workflow.
- Credential and state abuse follow when the poisoned memory is accepted as valid and reused across later agent decisions.
- Escalation happens as inflated or transferred context bypasses validation, drives unauthorised API calls, and spreads to downstream agents.
- Impact is corrupted decisions, workflow manipulation, and unauthorised access through AI-native systems that trust tainted memory.
Breaches seen in the wild
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
- 12,000 secrets in LLM training data: Truffle Security found 11,908 live API keys and passwords hard-coded in web pages captured by Common Crawl, a dataset used to train LLMs.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
MCP is becoming an identity problem, not just an AI plumbing problem: once memory drives API use and task continuation, the trust boundary shifts from the model response to the context object itself. That means provenance, persistence, and transfer rules are now part of access governance, especially where autonomous agents act on behalf of people or systems. Practitioners should treat context as an identity-bearing artefact.
Context provenance is the missing control concept: this article shows that the security failure is not only injection, but accepted context with no trustworthy origin signal. When agents cannot prove where memory came from or whether it was altered, validation becomes cosmetic. That is the specific governance gap this class of vulnerability exposes, and it should be named directly in NHI and agentic AI programmes.
Shadow memory creates governance debt: hidden or unaudited context that still influences decisions makes retrospective review unreliable. Standard logging tells you what the system saw, but not necessarily what it trusted when it acted. For teams building agent governance, the practical conclusion is that visibility must move to the point of memory creation and transfer.
Agent-to-agent transfers need the same scrutiny as privileged delegation: a context handoff is effectively a delegated trust decision, even when no human is involved. If source identity is not verified and content is not integrity-checked, one compromised agent can contaminate an entire workflow. Security teams should align this with the same rigor they apply to high-risk delegated access.
Memory integrity is now a control objective for AI-native workflows: the article is a reminder that corrupted state can be more damaging than a single bad prompt because it persists into later decisions. Once memory corruption influences approvals, routing, or tool use, blast radius expands quickly. Practitioners should map this risk into their AI governance, IAM, and NHI control models.
From our research library:
- Gartner predicts that by the end of 2026, 40% of enterprise apps will feature task-specific AI agents.
- Read next: Agentic AI Identity Maturity Model
What this signals
Context provenance will become a first-class control objective: if agents can remember, share, and reuse state across sessions, then memory needs the same governance attention as credentials and tokens. The next control shift is from reviewing decisions after the fact to validating context before it can influence action.
Agent memory is now part of the attack surface: the practical lesson for IAM and NHI teams is that privilege is no longer just about accounts and secrets. Where memory can trigger API calls or delegation, provenance checks and transfer rules must be aligned with the same control logic used for high-risk access.
Identity review processes will not be enough on their own: if a malicious context entry appears and disappears within a single workflow, there may be nothing durable to certify later. That makes memory integrity and runtime validation more important than retrospective review alone.
For practitioners
- Enforce context provenance checks Require signatures, checksums, or origin stamps on memory entries before agents can reuse or propagate them across steps.
- Limit prompt persistence across sessions Define which prompts, intermediate states, and execution traces may survive task boundaries, and block default carry-forward for high-risk workflows.
- Audit context deltas at runtime Compare memory snapshots at checkpoints to detect overwrites, inflation, or hidden additions that would not appear in normal logs.
- Verify agent-to-agent transfers Authenticate the source agent and validate the transferred payload before a receiving agent treats context as authoritative.
- Monitor for abnormal context growth Alert on spikes in entry count, size, or update frequency because these patterns often indicate inflation attempts or covert manipulation.
Key takeaways
- MCP vulnerabilities show that agent memory can become a trust boundary failure, not just a reliability issue.
- Because context can persist, move, and mutate across workflows, a single poisoned entry can distort later access and decision-making.
- The most effective control shift is to validate context provenance and transfers before agents are allowed to act on them.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | MCP context can expose or carry sensitive prompts and state across workflows. |
| NHI-04 — Insecure Authentication | Unverified context transfers and spoofed sources create weak trust in agent handoffs. | |
| NHI-08 — Environment Isolation | Context can cross task and agent boundaries unless memory boundaries are enforced. | |
| Recommendation — Scan agent context paths for leaked secrets and block reuse of exposed memory entries. Require authenticated context transfers before agents accept memory from another source. Separate high-risk agent contexts so memory cannot bleed across workflows or sessions. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Attacks exploit accepted context to influence privileged agent actions and delegation. |
| Recommendation — Constrain agent privileges so compromised context cannot expand what the agent is allowed to do. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The issue is governance over memory provenance, transfer, and trust in AI workflows. |
| Recommendation — Define ownership for context governance and require approval rules for memory reuse and transfer. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article shows malicious context used to reach privileged actions and spread across agents. |
| Recommendation — Map context abuse to credential access and lateral movement paths in your detection pipeline. | ||
Key terms
- Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
- Identity Provenance: Identity provenance is the record of how an agent was created, what authority it received, and what actions it performed over time. It turns agent activity into an auditable chain of trust that supports compliance, incident response, and post-event accountability.
- Shadow memory: Hidden or non-obvious agent state that influences behaviour without appearing in ordinary audit views. It is risky because security teams may believe they are monitoring the full decision path when the agent is actually consuming unlogged context.
- Context Inflation: An attack pattern in which an adversary floods an agent with enough runtime context to push critical validation material out of the effective decision window. The result is degraded reasoning, truncated controls, and a greater chance of silent misuse of APIs or workflow logic.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, human identity, identity lifecycle, and secrets management. It is designed for practitioners who need to connect identity controls to AI-native workflows and runtime trust decisions.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org