Notifications
Clear all
Topic starter
25/08/2026 9:13 am
TL;DR: MCP is becoming the default connective layer between AI agents and enterprise systems, but terra argues that the protocol also expands the attack surface through tool poisoning, secret exposure, scope creep, and weak auditability. The governance problem is no longer just model risk; it is whether organisations can continuously validate the tools, permissions, and trust boundaries their agents invoke in production.
NHIMG editorial — based on content published by terra: MCP Security Testing: Validating AI's Newest Attack Surface
By the numbers:
- 53% of MCP servers expose credentials through hard-coded values in configuration files.
- Only 18% of MCP server deployments implement any form of access scoping for tool permissions.
Questions worth separating out
Q: What breaks when MCP servers are exposed without identity controls?
A: Without identity controls, anyone with a link, key, or copied credential can reach tools and data outside policy.
Q: Why do MCP deployments complicate NHI governance?
A: MCP connects agents to tools in a way that can blur the line between a legitimate workload request and an uncontrolled execution path.
Q: How do you know if MCP security controls are actually working?
A: You know MCP controls are working when untrusted endpoints are blocked, privileged tool calls are minimal, and audit logs show only approved commands and data flows.
Practitioner guidance
- Inventory every MCP server as a governed identity boundary Map each server, tool, and connector to an owning team, access scope, credential type, and revocation path so production agents are never connected to an unowned trust boundary.
- Enforce short-lived, narrowly scoped credentials Replace static tokens and permissive secrets with short-lived credentials that are bound to a specific agent session and tool scope, then rotate or revoke them automatically.
- Re-test tool definitions on every change Treat updated schemas, tool descriptions, or connector changes as security events that trigger retesting for tool poisoning, confused deputy behaviour, and scope expansion.
What's in the full article
terra's full article covers the operational detail this post intentionally leaves for the source:
- The MCP risk table with specific categories such as token mismanagement, tool poisoning, and context injection.
- terra's testing workflow for enumerating exposed tools, probing parameter schemas, and reproducing exploitable paths.
- The change-triggered testing model that shows how continuous validation fits into an AI application pentesting programme.
- The reporting model that converts an MCP finding into audit-ready evidence for security and compliance teams.
👉 Read terra's analysis of MCP security testing and AI agent attack surface →
MCP security testing and AI agent governance: are your controls ready?
Explore further
25/08/2026 9:14 am
MCP has turned AI integration into an identity problem before it is a model problem. The important question is no longer whether an agent can reason through a task. It is whether the enterprise can govern the tool permissions, credentials, and trust boundaries that give that agent reach into production systems. For IAM and NHI teams, the control point has shifted to the protocol layer.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Our research also shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI agent takes action through an MCP server?
A: The accountable party is the human or team that authorised the agent's access, but only if the organisation can prove that chain. Without immutable logs that connect the initiating identity to the tool call and final action, accountability becomes weak, and legal or compliance teams lose the evidence they need.
👉 Read our full editorial: MCP security testing is becoming the control point for AI agents
