On this page
- What changed when the model started acting
- What exactly is an agent, and what is MCP?
- Which attack classes are actually new?
- Why do existing controls miss it?
- Which frameworks should you actually adopt?
- What does the EU AI Act require, and when?
- What should you do in the next ninety days?
- Five questions for the next board meeting
- Sources
Panop Research’s Agents, MCP and the New Perimeter (edition August 2026) is an awareness briefing on autonomous AI agents, the Model Context Protocol and the tool-calling estate now spreading through enterprise environments.
An AI agent is a non-deterministic actor: it decomposes a goal, selects its own tool calls, and executes them against production systems under delegated credentials. MCP standardises that access, and with it the blast radius. The result is a privileged identity class that no IAM, change-control or DLP boundary currently sees.
The full briefing is available via Download PDF above. What follows is the argument, not a reprint of the pages.
What changed when the model started acting
Until recently an enterprise language model was a text interface: it produced output and a human decided what to do with it. Agentic systems remove that step. The model selects a tool, invokes it, reads the result and chooses the next action, in a loop, at machine speed.
MCP, released by Anthropic in November 2024, standardised the model-to-tool connection. That made the pattern deployable at scale. It also turned thousands of independently written tool servers into one shared attack surface.
| Metric | Figure | Source |
|---|---|---|
| Servers in the official MCP registry, mid-2026 | 5,000+ | MCP registry |
| CVEs against MCP SDKs disclosed Jan-Apr 2026 | 40+ | Multiple advisories |
| MCP instances assessed vulnerable, April 2026 | 200,000 | OX Security |
| Package downloads in the affected supply chain | 150M+ | Cloud Security Alliance |
Standardisation is the point and the problem. One exploit now applies across thousands of deployed servers rather than one bespoke integration.
What exactly is an agent, and what is MCP?
AI agent: a language model given tools, memory and a control loop, permitted to take actions toward a goal with limited or no human confirmation at each step.
Model Context Protocol (MCP): an open standard for exposing tools, resources and prompts to a model through one uniform interface. By mid-2026 it is supported across the major assistants and development environments.
MCP server: a process that advertises tools to an agent and executes them. It may be first-party, open-source or vendor-hosted, and it runs with real credentials against real systems.
Tool poisoning: malicious instructions hidden in a tool’s description, schema or output, which the model reads as trusted context and then acts upon.
Non-human identity: the credential an agent authenticates with. It has no line manager, no joiner-mover-leaver process, and frequently no expiry.
An agentic system is a chain of five components, each with a different owner: trigger, model and planner, agent runtime, MCP client and servers, tools and data. Tool descriptions, schemas, outputs and credentials all sit inside the trust boundary, which means anything the model reads can influence what it does next.
Which attack classes are actually new?
Each class below has been demonstrated against production systems, most with a CVE or a named research write-up between mid-2025 and mid-2026.
| Attack class | What it is | Reference |
|---|---|---|
| Prompt injection, direct and indirect | Untrusted content the model reads becomes instruction. The common thread in nearly every agentic attack observed so far. | OWASP LLM01 |
| Tool poisoning and tool shadowing | Hostile instructions planted in a tool description or schema, or a rogue server silently overriding a legitimate tool. | Invariant Labs, May 2025 |
| Confused deputy and token passthrough | A server acts with its own broad privileges for a user who does not hold them, or a proxy is tricked into issuing a valid authorisation code. | CVE-2026-13341 |
| Rug pulls and supply-chain compromise | A vetted server changes behaviour in a later version. Install-time review does not catch what ships next. | Nx npm compromise |
| Rogue server registration | Weak registry vetting lets adversarial or hijacked servers be adopted as though legitimate. | Li and Gao, arXiv |
| Remote code execution in the plumbing | Command injection, DNS rebinding and localhost-binding flaws in clients, SDKs and inspectors rather than in the model. | CVE-2025-6514, CVE-2025-49596 |
| Excessive agency | The agent can do far more than the task requires because scopes are ambient and session-wide rather than per call. | OWASP LLM06 |
The combination that matters most is the lethal trifecta: external content, access to private data, and outbound network reach. An agent holding all three can be induced to exfiltrate, whatever the prompt said.
Almost none of these are model failures. They are identity, supply-chain and authorisation failures in the layer around the model.
Why do existing controls miss it?
The controls are not wrong. They are scoped to an actor that is provisioned, trained, supervised and accountable. An agent is none of those things.
| Control domain | The classic assumption | What an agent does instead |
|---|---|---|
| Identity and access | Users are provisioned and deprovisioned through joiner-mover-leaver. | Agents authenticate with long-lived tokens no HR process ever touches. |
| Authorisation | Permissions are checked once at the session boundary. | Ambient, session-wide scopes let one poisoned input reach every tool. |
| Change management | Code changes pass peer review before production. | A tool description or server update alters behaviour with no code change on your side. |
| Third-party risk | Suppliers are onboarded, assessed and reassessed. | MCP servers are added by developers in minutes, inside the trust boundary. |
| Data classification | Flows are mapped between known systems. | The agent assembles context at runtime, creating flows no diagram anticipated. |
| Logging and audit | Logs record who did what, to which record, when. | Without prompt and tool-call logging there is no record of why an action was taken. |
| Awareness and training | Staff are trained not to click the link. | The agent has no scepticism. It reads the instruction and complies. |
The governance move is not a parallel AI programme. Extend the seven domains you already run and give each an agentic acceptance criterion.
Which frameworks should you actually adopt?
Pick one spine, map the rest onto it, and turn the result into control statements an auditor can test.
| Framework | What it gives you | How to use it |
|---|---|---|
| NIST AI RMF 1.0 | Voluntary risk framework built on Govern, Map, Measure, Manage. | The operating spine, and the language for board-level reporting. |
| ISO/IEC 42001:2023 | The first certifiable AI management system standard. | Certify the organisation. Gives procurement a recognisable artefact. |
| OWASP LLM, Agentic and MCP Top 10 | Practitioner threat taxonomies. | Drive threat modelling and write security test cases from it. |
| MITRE ATLAS | Adversary tactics observed against AI-enabled systems. | Structure red-teaming and detection engineering. |
| CSA AI Controls Matrix | A technical control overlay across cloud and AI risk domains. | Derive auditable control statements and evidence requirements. |
| NSA / CISA MCP guidance | Government hardening guidance specific to MCP. | The baseline configuration checklist for every MCP server. |
Eight controls do most of the work: per-tool least-privilege scopes denying by default; short-lived tokens that never pass user credentials through; pinned server versions with provenance and signature checks; allow-listed servers from an internal registry; human confirmation gates on irreversible and financial actions; full logging of prompts, tool calls, parameters and outputs; egress control and network isolation for agent runtimes; and continuous red-teaming for injection and tool poisoning.
What does the EU AI Act require, and when?
Regulation (EU) 2024/1689 regulates systems placed on the market. ISO/IEC 42001 certifies the organisation managing them. Buyers increasingly ask for both.
| Date | What applies |
|---|---|
| 1 August 2024 | Regulation enters into force. |
| 2 February 2025 | Prohibited practices and the Article 4 AI literacy duty. |
| 2 August 2025 | Obligations for general-purpose AI model providers. |
| 2 August 2026 | Article 50 transparency duties; the Commission gains GPAI enforcement powers. |
| 2 December 2027 | Annex III standalone high-risk duties, moved back by the Digital Omnibus. |
| 2 August 2028 | High-risk AI embedded in regulated products. |
A certificate is not a legal defence. ISO/IEC 42001 certifies the management system, not any individual AI system, and carries no presumption of conformity under the Act. Ask which systems, sites and dates a certificate actually covers. Scope statements beat logos. Penalties reach €35 million or 7% of worldwide annual turnover for prohibited practices.
Note that high-risk application dates have already been amended once and may change again.
What should you do in the next ninety days?
Days 0-30, see. Publish an interim rule that no new MCP server is adopted without review. Inventory every agent, tool and server in use, developer machines included. List the credentials each agent holds and the systems it can reach. Name an accountable owner per agent. Switch on prompt and tool-call logging wherever the platform allows. Flag any agent holding all three legs of the lethal trifecta.
Days 31-60, contain. Replace long-lived tokens with short-lived, per-tool scoped credentials. Stand up an internal registry of approved servers with version pinning. Add human confirmation gates to irreversible and financial actions. Isolate agent runtimes and apply egress control. Fold agents into joiner-mover-leaver and access review cycles. Extend incident response with an agent kill switch and revocation path.
Days 61-90, prove. Map controls to NIST AI RMF functions and ISO/IEC 42001 clauses. Red-team the three highest-privilege agents for injection and poisoning. Add agentic criteria to procurement questionnaires. Brief the board on residual risk and agreed autonomy tiers. Decide the certification path and draft the scope statement. Set a quarterly reassessment, because the estate changes every month.
Five questions for the next board meeting
- Where can an agent commit this company (spend, contracts, customer data) without a human signing off?
- Who is accountable when an agent causes loss, and is that named in our risk register?
- If an agent were manipulated tomorrow, could we prove to a regulator or insurer what it did?
- What is our exposure through AI tools that teams adopted without procurement or security review?
- Are we on record with a position on the EU AI Act duties that apply from 2 August 2026?
If you cannot answer all five in one meeting, the inventory work in the first thirty days is where to start.
That inventory (every agent, the credentials it holds and every tool it can reach, prioritised by what is actually exploitable and revalidated as it changes) is the work Panop is built for. See AI-SPM, third-party risk and risk prioritisation, or book a demo.
Sources
This is an awareness briefing, not an audit, a penetration test or a legal opinion. Figures are reproduced as published by the cited source and were current at the edition date. The MCP ecosystem moves quickly. Re-verify counts, registry sizes and regulatory dates before any external use.
- Anthropic: Introducing the Model Context Protocol, November 2024, and the MCP specification
- NIST: AI Risk Management Framework 1.0 (AI 100-1), January 2023
- ISO/IEC: 42001:2023, AI management system
- OWASP: Top 10 for Large Language Model Applications, plus the MCP and Agentic AI Top 10
- MITRE: ATLAS, adversarial threat landscape for AI systems
- Cloud Security Alliance: AI Controls Matrix
- European Commission: regulatory framework for AI, Regulation (EU) 2024/1689
- NVD: CVE-2025-6514 and CVE-2025-49596
- Invariant Labs: GitHub MCP server data exfiltration, May 2025
- Li and Gao: A First Look at the Security Issues in the MCP Ecosystem, arXiv:2510.16558
- Simon Willison: the lethal trifecta, 2025
- NSA and CISA: Cybersecurity Information Sheet: Model Context Protocol (MCP) Security Design, June 2026