Topic starter
19/08/2026 3:37 pm
TL;DR: RSAC 2026 made MCP security a live governance problem, with practitioners confronting the fact that agentic AI behavior is driven by runtime data rather than static code, according to Obot. Existing identity, audit, and authorization models break when tool calls, prompts, and supply chain inputs all become part of the attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Obot: “The Trust Crisis: Why MCP Security Fails Autonomous Agents”.
Key questions
Q: What breaks when MCP security is treated as a single control layer?
A: Teams overestimate runtime coverage and miss the risks that sit above it.
Q: Why do MCP-based agents create more risk than ordinary API integrations?
A: Because the agent is choosing actions, chaining tools, and preserving context across steps.
Q: What are the signs that MCP governance is failing?
A: Common signs include agents reaching systems outside their intended workflow, incomplete audit trails for tool use, and data retrieval that cannot be tied back to a clear business purpose.
Practitioner guidance
- Centralize MCP enforcement Route agent tool calls through a single control point that can authenticate, authorize, and log every request before it reaches external systems.
- Inventory agent inputs and connectors Map every MCP server, skill, registry, and external data source that can influence an agent's runtime decisions, then remove anything you cannot govern.
- Replace static trust with runtime policy Scope permissions to the minimum tool set and data set needed for the task, then enforce policy at the moment of invocation rather than only at provisioning.
Bottom line: MCP security is best understood as a runtime governance problem because agentic systems behave according to live inputs, not fixed code alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:17 pm
MCP security is exposing a governance model built for deterministic software, not adaptive systems. The core failure is not just missing tooling, but the assumption that security can be validated once and then trusted at runtime. When the agent's decisions depend on live inputs, every static control becomes provisional, and identity teams have to treat runtime inspection as a first-class control plane.
A few things that frame the scale:
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: How should organisations govern agentic AI in observability workflows?
A: Treat AI as a bounded operator, not an all-purpose controller. Give it narrow permissions, require audit trails, and restrict it to approved actions such as validation, suggestion, or rollback of pre-defined changes. If the telemetry path is fragmented, fix that first, because agentic automation amplifies whatever control model already exists.
👉 Read our full editorial: MCP security exposes the limits of agentic AI governance