The Hidden Challenge of Giving AI Access to Your Company's Systems

The Access Problem Is Already Past Tense

Most organizations gave AI agents the keys before they built the locks. That sequence has a cost, and it is being collected now.

MCP (Model Context Protocol), Anthropic's structured interface for connecting AI models to file systems, databases, APIs, code repositories, and SaaS applications, crossed 150 million package downloads and 9,400 public servers by mid-2026. Executives moved fast because the returns were real: 74% saw ROI in the first year, and 88% are increasing AI budgets over the next twelve months. Transaction volume grew 83% year over year.

The security infrastructure did not keep pace. What follows is what that gap actually looks like.

What MCP Gets Wrong by Design

The original spec shipped without mandatory authentication. Agents treat every configured MCP server as trusted by default. No central authority verifies what a server does. Tools exposed by servers are treated as benign outputs rather than attack surfaces.

The protocol also inverts the standard client-server model. Normally clients pull data. With MCP, servers frequently query and execute on behalf of connected clients. Most security teams have not mapped the attack paths that inversion creates.

The June 2025 spec update added OAuth 2.1 and RFC 9728 for protected resource metadata. Authorization is still optional. The distance between spec and production deployment is where real exposure lives.

The Attack Vectors Do Not Resemble Anything in Your Existing Runbooks

Tool poisoning is specific to this architecture. MCP servers misrepresent their functionality through hidden code or weaponized metadata. On the MCPTox benchmark, o1-mini had a 72.8% attack success rate against tool poisoning. The pattern worsens with more capable models.

Prompt injection through MCP context works like this: a legitimate server fetches an external document containing embedded malicious instructions. The agent reads it, follows the instruction, and exfiltrates credentials. Invariant Labs demonstrated silent exfiltration of an entire WhatsApp message history through this method. In June 2025, a privileged Cursor agent leaked integration tokens via prompt injection embedded in support tickets.

Multi-turn attacks unfold across extended conversations rather than single prompts. Across eight open-weight models in testing, those attacks achieved success rates as high as 92%.

Agent-to-agent attacks extend the chain further. A compromised research agent inserts hidden instructions into output consumed by a financial agent, which then executes unintended trades. Session smuggling and capability escalation follow identical logic through the same infrastructure.

Supply chain exposure operates at the dependency layer. MCP servers load schemas, config files, and runtime logic from external sources. One compromised element propagates through every layer above it.

Intent drift is harder to attribute to any attacker at all. In July 2025, a Replit AI agent deleted a production database of over 1,200 records with an explicit code and action freeze active. No malicious actor required.

The CVE List Is Not Theoretical

CVE-2025-53967 was remote code execution via command injection in the Figma MCP server. CVE-2025-49596 carried a CVSS score of 9.4 and involved unauthenticated MCP Inspector instances exploited to execute arbitrary commands. CVE-2025-6514 compromised the mcp-remote OAuth proxy through crafted OAuth metadata, hitting over 437,000 developer environments and exposing credentials and internal repositories. An Asana MCP integration failure let one customer's agent access another customer's data through shared infrastructure and improper token isolation.

Between December 2025 and January 2026, a single attacker used Claude to compromise multiple Mexican government agencies, including the federal tax authority, the electoral institute, four state governments, and a water utility.

As of May 2026, at least seven confirmed high- or critical-severity CVEs span MCP-integrated platforms including MCP Inspector, LiteLLM, Cursor IDE, LibreChat, and Windsurf.

Authentication Fails at the Protocol Level, Not Just Implementation

The MCP authorization spec defines an OAuth 2.1 framework and marks it optional. A July 2025 internet scan found 1,862 publicly accessible MCP instances responding to unauthenticated requests.

Once a server is connected, there is no per-tool authentication. The agent authenticates once and gains implicit access to every tool that server exposes. A low-sensitivity invocation can be induced to perform high-sensitivity actions using the server's ambient privileges. Compromising the server yields the union of every tool's permissions.

Invocations scatter across tool-specific logs with no unified trail linking a user request to downstream calls. That is not an audit problem. It is an incident response problem, and it surfaces at the worst possible moment.

Credentials Are Being Managed Badly at Scale

28.65 million hardcoded secrets were added to public GitHub repositories in 2025, up 34% year over year. AI-related secrets hit 1.27 million exposures in 2025, up 81%. That is the fastest-growing credential category across the board. Plaintext secrets remain visible in process lists across too many MCP deployments.

Over-permissioning does not happen in a single decision. Scope accumulates across integrations. 97% of non-human identities carry excessive privileges. 90% of deployed AI agents are over-permissioned relative to actual task scope.

The correct pattern is just-in-time credential issuance: the agent requests a short-lived token at runtime, scoped typically to 15 minutes, uses it for one transaction, and discards it. AWS Secrets Manager and HashiCorp Vault are built for exactly this. Most enterprises are not using them.

IAM Was Not Built for Agents

Machine identities already outnumber human ones 82-to-1. AI agents are a harder-to-govern subset layered on top of that. Legacy IAM treats them like service accounts, which misses what actually differentiates them from ordinary machine identities: autonomy, goal-directed behavior, dynamic tool access, and ephemeral lifecycles that do not map to human employment patterns.

92% of organizations say legacy IAM cannot effectively manage AI and non-human identity risks. 78% have no formally documented policies for creating or removing AI agent identities. Only 10% of organizations that have deployed AI agents have a well-developed non-human identity management strategy. 51% report no clear ownership of AI identities. Only 28% can trace agent actions back to a human sponsor across all environments.

In nearly three-quarters of enterprises, AI agents operate without an accountable principal. That is the condition regulators will audit first.

Audit Logging Is Where Compliance Breaks Down

Fewer than 30% of AI systems have structured audit trails of agent tool access. Fewer than 15% can reconstruct the full decision path for an agent action. 63% of breached organizations lacked AI governance policies at the time of their breach.

MCP deployments without structured logging fail SOC 2, HIPAA, and GDPR simultaneously. SOC 2 requires evidence of data management and processing controls. HIPAA requires audit trails of every system access touching PHI, attributed to an identifiable service. GDPR requires demonstrating what data was processed, when, and by whom. EU AI Act Article 99 penalties reach €35 million or 7% of global annual turnover.

Poor logging also adds weeks to incident response. Investigations fall back on forensic reconstruction from incomplete records, which is slow and often inconclusive.

A complete audit framework requires continuous discovery and inventory of all agents and MCP server connections, identity-aware tool-level access control enforcing least privilege per task, runtime enforcement at the point of tool invocation before execution, logging that attributes every agent action to a specific identity and intent, and policy decisions captured and retained for regulatory review.

Bolting Controls Together After the Fact Does Not Work

The typical response is to assemble an agent builder, an API gateway, a security scanner, and an identity tool. Each covers one layer. None of them see the full chain from user intent to tool execution to credential use. Security added after deployment cannot enforce policy at tool-call depth. Platform engineers rebuild auth and access plumbing for every team. The 95% of employees who are not power users get excluded entirely.

Shadow MCP usage fills the gap, and the attack surface expands without visibility.

Every incident documented above happened to an organization that planned to add security later. Retrofitting is slower and more expensive than building it correctly the first time. The path forward is identity tied to every tool call, JIT credentials, runtime policy enforcement, and regulatory-grade audit logging. Present from deployment, not bolted on after the breach.