MCP server exposure shows why AI agent access needs governance

At a glance

What this is: A Salt analysis says a vulnerable Figma MCP server showed how AI-to-application channels can become an abuse path for command injection, remote code execution and downstream data theft.

Why it matters: IAM, PAM and NHI teams need to treat MCP-connected AI agent access as governed identity traffic, because trust assumptions at the integration layer can collapse into application compromise.

Context

Model Context Protocol, or MCP, is the connection layer that lets an AI agent invoke tools and applications at runtime. In this case, the concern is not the model itself but the trust placed in the server that brokers those calls, because a compromised MCP endpoint can impersonate legitimate agent activity.

For identity programmes, that means AI agent access is no longer just an API integration issue. It becomes a governance problem across authentication, authorisation, input handling and runtime monitoring, especially when a server can act inside trusted application workflows.

The article’s central warning is that adoption is moving faster than control maturity. That is a typical pattern for emerging identity surfaces, where teams inherit legacy assumptions about trusted automation and discover too late that those assumptions do not hold for agent-driven access.

Key questions

Q: What breaks when MCP servers run locally without governance?

A: Local MCP servers inherit workstation privileges, which means they can read plaintext secrets, access user-scoped tools, and operate without a central approval point. That breaks the assumption that credential use is limited to known services. The practical result is hidden NHI sprawl, with no reliable inventory or review path for the identities doing the work.

Q: Why do MCP-connected agents increase AI data leakage risk?

A: MCP-connected agents can retrieve data directly from enterprise systems, so sensitive information may enter AI workflows without a person copying it into a prompt. That creates a delegated retrieval path, which expands the attack and compliance surface. Organisations need policy controls on what the agent may retrieve and what may be passed onward to the model.

Q: How should security teams evaluate AI agent authorization tools?

A: Score every tool on whether it enforces policy before execution, covers all relevant domains, makes decisions with runtime context, and can prove the basis for each decision. If the product only detects activity or needs manual workflows to change permissions, it is not giving you full authorization control. The safest test is a live denied action, not a feature checklist.

Q: What should teams do after an endpoint management system is compromised?

A: Treat the incident as a privileged access event, not only an endpoint event. Revoke active administrative sessions, rotate any exposed credentials or tokens, and review whether the management plane could reach other device classes or downstream consoles. Containment has to start with the access paths that the system itself controlled.

Technical breakdown

Why MCP servers expand the trusted attack surface

MCP creates a standard way for AI agents to request actions from tools and applications, which is useful but also expands the number of identity-bearing entry points. Each server becomes a policy boundary that must decide what an agent may ask for, what the backend may execute, and whether the request context is trustworthy. The risk is not abstract connectivity. It is that a new integration layer often ships before mature controls for request validation, scoped authorisation and auditability are in place. In practice, the server becomes a high-trust broker for actions that should be tightly bounded.

Practical implication: treat every MCP server as a governed access layer, not a passive integration endpoint.

How command injection turns an agent channel into server compromise

The exploit path described in the article is a classic command injection pattern. A malicious value is passed through an API parameter that the server expects to hold benign data, and the backend then concatenates or executes that value in a shell context without adequate sanitisation. Once the backend trusts user-controlled input, the attacker no longer needs to break the AI system itself. They only need to reach the function that bridges agent requests into system execution. That is why input validation and execution isolation matter so much in AI-connected services.

Practical implication: review agent-facing endpoints for unsafe command execution paths before exposing them to production workloads.

Why AI agent access needs lifecycle and visibility controls

When an MCP server can be abused, the impact is not limited to the original request. A compromised channel can exfiltrate data, modify files or provide a stepping stone into other systems, all while appearing as legitimate agent traffic. That makes agent access a lifecycle issue as much as an authentication issue. Teams need to know which agents can reach which tools, which credentials they use, and what activity is normal for each integration. Without that inventory, response teams cannot separate expected automation from malicious use of the same channel.

Practical implication: build explicit inventories, scope boundaries and logging for each AI agent integration path.

Threat narrative

Attacker objective: The attacker aims to turn a trusted AI integration path into server control, then use that foothold to access data and move deeper into the environment.

1. Entry occurred through a vulnerable MCP server function that exposed an AI-to-application channel to attacker-controlled input.
2. Credential or command abuse happened when a malicious OS command was injected into an API parameter the server expected to process as ordinary data.
3. Escalation followed when flawed input validation allowed that payload to execute as a shell command, resulting in remote code execution on the server.
4. Impact extended to data exfiltration, system manipulation and possible lateral movement from the compromised server into the wider environment.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent access governance is now an application security issue, not just an identity issue: MCP changes the point of control from human login flows to machine-mediated action flows. That means authorisation, input validation and telemetry all need to be designed for runtime agent behaviour, not static user sessions. The practitioner lesson is that identity policy must follow the action path, not just the account.

MCP server exposure creates a new form of identity trust debt: teams are assuming that a protocol boundary is trustworthy because the caller is an AI agent, but the article shows that the broker itself can become the vulnerability. That assumption fails when the server executes untrusted input in backend contexts. The implication is that agent connectivity cannot be governed as if it were a benign internal automation channel.

Runtime input control is the missing governance layer for AI-to-application traffic: the exploit worked because a data field was allowed to influence command execution. That is a specific control failure, not a generic AI risk. For NHI and agentic programmes, the practical conclusion is that request validation and execution isolation must be treated as identity-adjacent controls for every MCP integration.

Agentic access blast radius: once a trusted channel is compromised, the blast radius is determined by what the server can reach, not by what the agent was supposed to do. That is why inventory, scope limitation and monitoring become part of access governance. Practitioners should assume that any over-broad agent channel can become a bridge into adjacent systems.

AI adoption speed is outpacing governance maturity across the identity stack: the article’s data point about broad GenAI adoption sits alongside low confidence in detection and response, which is the pattern that matters. The issue is not whether organisations will use these channels, but whether they can prove what each channel is allowed to do. The practitioner conclusion is to govern AI integrations with the same discipline applied to other high-risk machine identities.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Agentic access must be governed as a runtime trust problem: once an AI agent can reach business applications through MCP, the important control question is no longer who logged in, but what the broker can execute on the agent’s behalf. That shifts programme design toward scoped tool access, command safety and delegated authority boundaries rather than generic automation approval.

Trust debt accumulates when integration layers outpace identity controls: MCP, service accounts and backend execution often land before teams have mapped ownership, approval paths and telemetry. The result is a gap between apparent automation and actual governance. Practitioners should expect more incidents where the exposed weakness is the connector, not the model.

Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs, which is why agent channels so often inherit unchecked privilege. The right response is to inventory the identities behind every AI integration before the channel becomes a shadow access path.

For practitioners

• Define explicit MCP trust boundaries Classify every MCP server as a governed access broker with a named owner, approved tools, and documented allowed actions for each AI agent integration.
• Remove shell execution from agent-facing paths Audit API handlers for command construction from user-controlled fields and isolate any unavoidable execution behind strict allowlists and service-side wrappers.
• Inventory agent credentials and scopes Record which agents can reach which applications, what credentials they use, and which privileges are required for each interaction path.
• Monitor for abnormal agent traffic patterns Baseline expected request shapes, command frequency, and target resources so suspicious agent activity stands out in logs and API telemetry.
• Test compromise paths from MCP to adjacent systems Assume a server-side compromise and trace what data, tools, and internal services become reachable if the MCP endpoint is abused.

Key takeaways

• MCP servers create a governed access problem because they let AI agents act inside trusted application workflows, which expands the attack surface beyond the model itself.
• The exploit pattern in the article combined unsafe input handling with backend command execution, showing that a single exposed endpoint can become server compromise.
• Practitioners should treat AI agent access as privileged machine access, with explicit scope, logging, inventory and execution isolation around every integration path.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• AI Agent Access Control: AI agent access control is the discipline of governing what an autonomous software agent can see, change, and trigger at runtime. It combines identity, task scope, approval, and audit so the agent’s effective power stays narrower than its theoretical capability.
• Command injection: Command injection occurs when attacker-controlled data is inserted into a shell command and changes what the process executes. In AI tooling, that often happens through wrappers, plugins, or installation flows that turn paths or prompts into shell strings. The impact is privilege abuse through the process’s inherited authority.
• Metadata Trust Boundary: A metadata trust boundary is the line between tool content that can be safely consumed and tool content that must be validated before use. For agentic systems, descriptions, examples, and schemas are security-relevant inputs because they can influence decisions and trigger actions with real-world impact.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.