MCP Security: Why Your AI's Most Powerful New Protocol Is Also Its Biggest Attack Surface
Your agents can already read your inbox, query your databases, and write back to your CRM. The protocol that makes that possible was never built with an attacker in mind.
Watch On Demand – MCP Security: Why Your AI’s Most Powerful New Protocol Is Also Its Biggest Attack Surface
MCP normalized how every AI agent in your enterprise talks to every external system, the same way USB normalized how a laptop talks to a printer. That normalization is exactly what makes it dangerous. A hidden instruction in a resume, a GitHub issue, or a shared drive document doesn’t need to fool a person anymore. It just needs to fool the agent reading it on your behalf.
This session breaks down what MCP actually enables, where the real attack vectors live, and what governing it looks like in practice.
Key Takeaways:
- The blast radius changed. A bad output from an AI model was a recoverable mistake. An agent that acts on it, by sending an email, calling an API, or writing to a system of record, is not.
- Your firewall, DLP, and IAM stack won’t catch this. MCP traffic is authenticated and encrypted, so it looks like normal application traffic. Agents summarize sensitive data in language that skips known DLP signatures. And agents typically run under the calling user’s identity, so IAM can’t isolate them.
- Three vectors do the most damage. Prompt injection hidden in content an agent fetches, tool manifests that hand agents more access than their task requires, and the read/write bidirectionality that turns a compromised agent into an exfiltration path.
- Governance has to happen at the moment of execution. Logging a bad tool call after it already ran doesn’t help. Real protection means real-time policy enforcement, dynamic tool scoping, a queryable audit trail with full reasoning context, and injection detection that catches adversarial instructions before the model ever processes them.
Watch on demand and get a clear framework for where MCP actually breaks and what governing it looks like in practice.