Notifications
Clear all
Topic starter
02/08/2026 11:32 am
TL;DR: A flaw in a Figma MCP server showed how AI-to-application channels can be turned into remote code execution, data exfiltration, and lateral movement, while Salt’s 2025 State of API Security report found 62% of organisations have already adopted GenAI for some or all API development. The security gap is not adoption itself, but the lack of mature identity and input-control assumptions around emerging AI agent pathways.
NHIMG editorial — based on content published by Salt: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- 62% of organizations have already adopted GenAI for some or all of their API development.
- 56% now view Generative AI as a growing security concern.
- 47% cited the difficulty in understanding and securing AI-generated code itself.
Questions worth separating out
Q: What breaks when an AI integration server is treated like ordinary application plumbing?
A: The access model breaks first.
Q: Why do MCP-style AI channels increase the risk of NHI misuse?
A: Because they rely on credentials, tokens, or service paths that can act on behalf of a system rather than a person.
Q: How can organisations tell whether an AI agent is operating outside its intended boundary?
A: Look for inconsistent classifications, premature tool calls, fabricated inputs, and responses that ignore structured guardrails.
Practitioner guidance
- Classify MCP servers as privileged access paths Map every AI-facing API or protocol bridge to the business application it can influence, then assign an owner, scope, and review cadence as if it were a non-human identity with delegated authority.
- Harden AI integration inputs before execution Apply strict allowlisting, sanitisation, and command segregation to any parameter that can influence downstream shell, file, or application actions.
- Inventory AI-linked credentials and tokens List the service accounts, API keys, and delegated tokens used by AI agents and MCP servers, then track where each one can act and whether the access can be revoked independently.
What's in the full article
Salt's full analysis covers the operational detail this post intentionally leaves for the source:
- The exact API function pattern that made the MCP server vulnerable and why it mattered for AI retrieval workflows.
- The reported experiment details around command injection and remote code execution in the application layer.
- The broader API security findings from Salt's 2025 State of API Security report and how they frame AI adoption risk.
- The vendor's behavioural threat-protection framing for AI agent traffic and how it is positioned for API monitoring.
👉 Read Salt's analysis of MCP server risk and AI-driven API attack paths →
MCP server exposure: what it means for AI agent access controls?
Explore further
02/08/2026 12:47 pm
AI integration is now an identity problem, not just an API problem: Once an MCP server can trigger actions on behalf of an AI system, it inherits the trust expectations of a non-human identity. That changes the governance question from "is the endpoint reachable" to "what authority does this path possess, and how is it constrained." Practitioners should stop treating MCP as a simple transport mechanism and start classifying it as an access-bearing control surface.
A few things that frame the scale:
- 62% of organisations have already adopted GenAI for some or all of their API development, according to Salt Security’s 2025 State of API Security report analysis.
- 56% now view Generative AI as a growing security concern, which shows the governance problem is already visible to security teams.
A question worth separating out:
Q: Who is accountable when an AI agent takes action through an MCP server?
A: The accountable party is the human or team that authorised the agent's access, but only if the organisation can prove that chain. Without immutable logs that connect the initiating identity to the tool call and final action, accountability becomes weak, and legal or compliance teams lose the evidence they need.
👉 Read our full editorial: MCP server exposure shows why AI agent access needs governance
