MCP security layers expose the governance gap in agentic AI

At a glance

What this is: Akto frames MCP security layers as embedded checkpoints for accepting, storing, and recalling context in agentic AI, with the main finding that governance failures emerge when untrusted context reaches memory and runtime decisions.

Why it matters: IAM and AI security teams need to treat context trust, session isolation, and scoped permissioning as core controls because agentic systems can turn weak context governance into unauthorized actions and data exposure.

Context

MCP security layers sit in the control path between incoming context and the agent’s runtime decisions. In practical terms, they try to decide which prompts, memory writes, session signals, and tool-facing instructions are trusted enough to influence behaviour. That matters because agentic AI governance breaks down when systems assume every context source is equally trustworthy.

The article’s core concern is not model capability alone, but the boundary around context flow. Once prompt chaining, memory reuse, or session leakage is possible, traditional access control thinking becomes too coarse. For identity and AI governance teams, this is where non-human identity, session scope, and runtime policy intersect.

Akto’s starting position is typical of the current market: governance pressure is shifting from model output moderation toward control of the inputs, memory, and interactions that shape output.

Key questions

Q: What breaks when agent context is not trusted before execution?

A: When context is accepted without validation, an attacker can steer the agent with injected instructions, chained prompts, or malformed metadata that look operationally normal. The result is not just bad output. It is policy bypass, unauthorised action, and hidden state corruption that can persist across later interactions.

Q: Why do unisolated agent memory and session leakage increase risk?

A: Agent memory creates persistence, so weak isolation lets one interaction influence another through overwritten, reused, or exposed context. That widens the blast radius from a single task to the whole session estate. It also makes sensitive data harder to contain because the model can recall it later from an unexpected path.

Q: How do teams know if runtime controls are actually working?

A: They should be able to trace a decision from source event to applied rule to final outcome without gaps. If that lineage is incomplete, the control may look correct in reports while failing in practice. Real governance shows up in explainable timing, not just in end-of-period summaries.

Q: Why do AI agents need identity-style governance rather than only content filters?

A: Because an agent can read, write, and act on context, it behaves like a non-human identity with scope, permissions, and state. Content filters only judge text. Identity-style governance controls who or what can influence the agent, which memory it can touch, and which actions it can perform.

Technical breakdown

Context validation as a trust boundary

MCP-style security layers treat incoming context as untrusted until it passes validation. That validation can check source, prompt structure, chain length, and whether the request matches allowed behaviour before the agent acts. This is a different security problem from classic content moderation because the issue is not only what the model says, but what it is allowed to ingest and preserve. In agentic systems, a malicious prompt can look like ordinary workflow input while still steering decisions. The practical design challenge is therefore to stop unsafe context before it becomes durable state or tool invocation.

Practical implication: validate context at ingestion, not after the model has already acted.

Memory isolation and session leakage

Agent memory creates persistence across interactions, which is useful for continuity but dangerous when isolation is weak. If sensitive memory is shared across sessions, overwritten by untrusted inputs, or recalled without scope checks, one interaction can contaminate another. That is why memory protection in agentic systems is effectively an identity and access problem: the system must decide who or what can write, read, and reuse context at each step. The article’s model also implies that memory controls need encryption, classification, and reset behaviour, not just logging. Without that, memory becomes the easiest route to cross-session exposure.

Practical implication: separate session memory from persistent agent state and restrict recall by scope.

Runtime enforcement against chaining and drift

Static filters are not enough when an attacker can gradually alter intent through chained prompts or repeated context pivots. Runtime enforcement adds behavioural checks while the agent is executing, looking for patterns that indicate escalating manipulation, out-of-scope action, or output drift. In governance terms, this is the difference between reviewing a policy and continuously enforcing it during the session. For agentic AI, that matters because the risky action may occur after several seemingly harmless exchanges. Runtime gating, rollback, and execution locks are therefore part of the control plane, not optional hardening layers.

Practical implication: monitor for chaining and drift during execution, and terminate unsafe sessions before tool use escalates.

Threat narrative

Attacker objective: The attacker wants to steer the agent into unsafe behaviour, extract hidden context or memory, and trigger unauthorised actions through trusted runtime pathways.

1. Entry occurs when an attacker supplies untrusted prompt input, manipulated context, or chained instructions that resemble legitimate workflow data.
2. Credential or state abuse follows when the agent accepts or reuses poisoned memory, session data, or scoped metadata without strong isolation.
3. Escalation and impact occur when the agent executes out-of-scope actions, leaks internal context, or violates policy through runtime drift and chained manipulation.

Breaches seen in the wild

• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP security layers reveal a governance truth that many agent programmes still avoid: the model is not the only thing that needs securing. The real control point is the path by which context becomes decision material, which is why validation, memory, and runtime enforcement now matter together. In agentic environments, governance fails when the system trusts inputs that should have stayed provisional.

Context trust gap: this is the failure mode that MCP security is trying to close. Prompt injection, chaining, and memory poisoning are different attack styles, but they exploit the same weakness: untrusted context gains policy-shaping influence. That makes context provenance and session scoping central to AI governance, not a niche implementation detail. Practitioners should treat this as a control gap, not a model quirk.

Identity controls are becoming agent controls. Once an AI system can read, write, and reuse memory or invoke tools, it behaves like a non-human identity with permissions and state. That means IAM and NHI teams need to care about session boundaries, scoped permissions, and privilege inheritance in AI workflows. The practical conclusion is that agent governance belongs inside identity governance, not beside it.

Runtime enforcement will matter more than pre-deployment policy alone. The article points to a broader shift in AI security where static approval is insufficient because manipulation happens during execution. Behaviour locks, rollback, and chaining detection are forms of operational governance for systems that can change state mid-task. Practitioners should expect control maturity to be measured at runtime, not only at design time.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Agentic AI Identity Guide

What this signals

Context trust is becoming the control plane for agentic AI. Security programmes that still focus mainly on prompt filtering will miss the larger issue, which is whether untrusted context can alter memory, tool use, or downstream decisions. The governance model has to move closer to issuance time, because that is where unsafe influence starts.

Agent identity and NHI governance are converging. Once an AI system can maintain memory, inherit permissions, and execute actions, it is no longer useful to treat it as a passive application. That is why 67% of organisations still relying on static credentials is a warning sign for agentic deployments according to the 2026 Infrastructure Identity Survey.

Runtime assurance will become the deciding capability. Static policy documents will not be enough if chaining, drift, and poisoned context can all unfold inside a live session. Practitioners should expect control maturity to depend on continuous validation, memory scoping, and the ability to halt unsafe execution before the agent completes the task.

For practitioners

• Map agent context sources to trust levels Inventory which modules, prompts, logs, and external tools can influence agent decisions, then classify them by trust level and sensitivity before they reach memory or execution.
• Isolate session memory from persistent state Separate ephemeral task memory from longer-lived agent state, and prevent one user session from reading, overwriting, or reusing another session’s context.
• Add runtime checks for chaining and drift Detect repeated prompt pivots, growing instruction chains, and output deviations during execution, then block tool use when the session crosses policy boundaries.
• Scope privileged agent actions explicitly Require role-aware permissions for memory reads, memory writes, and tool invocation so that elevated agent behaviour is tied to narrowly defined tasks.

Key takeaways

• MCP security layers are best understood as governance checkpoints for context, memory, and runtime behaviour in agentic AI.
• The main exposure is not only prompt manipulation, but the way untrusted context can persist into memory and tool execution.
• Security teams need controls that validate inputs, isolate sessions, and stop unsafe runtime behaviour before it becomes policy drift.

Key terms

• Context Poisoning: Context poisoning is the manipulation of information that an AI agent reads before acting. The malicious content does not need to be code. If it changes the agent’s instructions, tool choices, or assumptions, it can alter behaviour and expand the impact of a compromised delivery path.
• Session Isolation: Session isolation is the separation of one user’s prompts, memory, and retrieved context from another’s. In AI systems, weak isolation can cause cross-user leakage, especially in multi-tenant platforms or shared assistant workflows where previous data remains reachable.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Chained exploit: A chained exploit combines multiple weaknesses to achieve a result that no single flaw would provide on its own. Security teams need to think about these chains because browser bugs, runtime flaws, and privilege escalation steps often work together to turn a partial foothold into full compromise.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and secrets management for practitioners who need to control non-human access and runtime trust. It is designed for teams responsible for identity, security architecture, and operational governance across modern AI systems.