Topic starter
02/08/2026 12:18 pm
TL;DR: Nearly 63% of AI-driven security incidents are linked to manipulated context, and testing for AI systems that trust contextual inputs is focused on validation, tool chaining, and protocol controls, according to Akto. Context integrity, not just model robustness, is now the deciding control boundary.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “MCP Penetration Testing: Strengthening AI Security Through Context Integrity”.
Key questions
Q: What breaks when MCP context is not validated before an AI agent acts on it?
A: The system can turn untrusted context into trusted action.
Q: Why do weak authentication and open MCP endpoints increase AI security risk?
A: They let attackers intercept or inject context before the model evaluates it.
Q: How do you know if MCP security controls are actually working?
A: You know MCP controls are working when untrusted endpoints are blocked, privileged tool calls are minimal, and audit logs show only approved commands and data flows.
Practitioner guidance
- Map MCP trust boundaries Document every path from agent to MCP client, MCP server, and external tools, then mark where context is created, transformed, validated, and consumed.
- Enforce authentication on every MCP endpoint Require strong authentication, protected transport, and access scoping for all endpoints that can contribute context to agentic workflows.
- Test for context injection as a control failure Run controlled malicious input tests to confirm that unverified context cannot alter tool calls, model outputs, or downstream workflow decisions.
Bottom line: MCP testing exposes a security gap where AI systems trust context too easily, allowing manipulated inputs to shape decisions and actions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:19 pm
Context integrity is now a first-class security control for agentic AI. MCP testing shows that the real failure is not simply an incorrect model answer, but a system that cannot prove which context deserves trust. That shifts the security question from output quality to decision-path integrity. Practitioners should treat context validation as part of the control plane, not a downstream tuning exercise.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations test MCP security separately from traditional penetration testing?
A: Yes. Traditional pentesting finds infrastructure and application flaws, but MCP testing checks whether context handling, tool chaining, and validation logic can be manipulated. Both matter, but they answer different questions. Agentic systems need assurance over runtime decision paths, not only over exposed services.
👉 Read our full editorial: MCP penetration testing exposes the context integrity gap in AI security