Notifications
Clear all
Topic starter
21/08/2026 4:59 pm
TL;DR: MCP gives AI agents direct access to tools and data, but the protocol itself ships without built-in identity, access control, or audit safeguards, according to AccuKnox. That leaves enterprises relying on layered Zero Trust controls, because tool poisoning, prompt injection, and overprivileged sessions can turn a useful integration into an uncontrolled access path.
NHIMG editorial — based on content published by AccuKnox: MCP Security Explained: Why AI Agents Need Zero Trust
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- Only 18% of MCP server deployments implement any form of access scoping for tool permissions.
- 53% of MCP servers expose credentials through hard-coded values in configuration files.
Questions worth separating out
Q: How should security teams govern AI agents that use service accounts and MCP tools?
A: Start with ownership, then add runtime attribution and containment.
Q: Why do MCP-based agents create more risk than ordinary API integrations?
A: Because the agent is choosing actions, chaining tools, and preserving context across steps.
Q: What do security teams get wrong about AI and zero trust?
A: They often treat zero trust as a one-time architecture choice instead of continuous verification.
Practitioner guidance
- Bind each agent to a distinct identity Use per-agent workload identity rather than shared API keys or common service tokens, and make the credential scope match a single user or tenant context.
- Scope tool permissions to explicit task needs Map each MCP tool to a narrow role and deny default access to unrelated tools, data sets, and write operations.
- Separate input trust from execution trust Inspect untrusted content before it reaches the model, then enforce a second policy layer before any tool call is executed.
What's in the full article
AccuKnox's full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step MCP security architecture covering prompt firewall, runtime telemetry, and kernel-level enforcement.
- Concrete configuration examples for securing MCP workloads in Kubernetes and limiting outbound behaviour.
- A phase-by-phase roadmap for static scanning, active probing, and shadow MCP detection.
- A catalog of live MCP use cases and the specific tools exposed by the AccuKnox server.
👉 Read AccuKnox's analysis of MCP security and Zero Trust controls for AI agents →
MCP security for AI agents: are your controls keeping up?
Explore further
21/08/2026 5:15 pm
MCP security is really a control problem, not a protocol problem: the protocol can move requests and responses, but it cannot decide who should be allowed to act. That means enterprises inherit the burden of identity binding, authorization scoping, and auditability at every tool boundary. The practitioner conclusion is simple: MCP should be treated as an identity plane for agents, not just a developer convenience.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface.
- A separate finding in the same report shows that 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
A question worth separating out:
Q: How can organisations tell if an MCP server is safe enough to use?
A: Look for evidence that every tool is bound to a narrow role, every session is logged, every credential is short lived, and unexpected outbound behaviour is blocked at runtime. If any one of those elements is missing, the environment is still relying on trust rather than control.
👉 Read our full editorial: MCP security shows why AI agent access needs zero trust
