Topic starter
02/08/2026 11:32 am
TL;DR: A flaw in a Figma MCP server showed how AI-to-application channels can be turned into remote code execution, data exfiltration, and lateral movement, while Salt’s 2025 State of API Security report found 62% of organisations have already adopted GenAI for some or all API development. The security gap is not adoption itself, but the lack of mature identity and input-control assumptions around emerging AI agent pathways.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “Anatomy of a Modern Threat: Deconstructing the Figma MCP Vulnerability”.
Key questions
Q: What breaks when MCP servers run locally without governance?
A: Local MCP servers inherit workstation privileges, which means they can read plaintext secrets, access user-scoped tools, and operate without a central approval point.
Q: Why do MCP-connected agents increase AI data leakage risk?
A: MCP-connected agents can retrieve data directly from enterprise systems, so sensitive information may enter AI workflows without a person copying it into a prompt.
Q: How should security teams evaluate AI agent authorization tools?
A: Score every tool on whether it enforces policy before execution, covers all relevant domains, makes decisions with runtime context, and can prove the basis for each decision.
Practitioner guidance
- Define explicit MCP trust boundaries Classify every MCP server as a governed access broker with a named owner, approved tools, and documented allowed actions for each AI agent integration.
- Remove shell execution from agent-facing paths Audit API handlers for command construction from user-controlled fields and isolate any unavoidable execution behind strict allowlists and service-side wrappers.
- Inventory agent credentials and scopes Record which agents can reach which applications, what credentials they use, and which privileges are required for each interaction path.
Bottom line: MCP servers create a governed access problem because they let AI agents act inside trusted application workflows, which expands the attack surface beyond the model itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:47 pm
AI agent access governance is now an application security issue, not just an identity issue: MCP changes the point of control from human login flows to machine-mediated action flows. That means authorisation, input validation and telemetry all need to be designed for runtime agent behaviour, not static user sessions. The practitioner lesson is that identity policy must follow the action path, not just the account.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should teams do after an endpoint management system is compromised?
A: Treat the incident as a privileged access event, not only an endpoint event. Revoke active administrative sessions, rotate any exposed credentials or tokens, and review whether the management plane could reach other device classes or downstream consoles. Containment has to start with the access paths that the system itself controlled.
👉 Read our full editorial: MCP server exposure shows why AI agent access needs governance