AI security has moved beyond prompt injection.
The real risk is no longer just that a model may produce an unsafe answer. The bigger risk is that an agent may take an unsafe action — using real tools, permissions, data, and business workflows.
That is why the Model Context Protocol, or MCP, has become a critical security boundary. MCP standardizes how agents discover tools, retrieve context, and act across enterprise systems. This makes agents more useful, but it also expands the attack surface from the prompt to the full execution path.
For security teams, the question is no longer only, “Can the model be jailbroken?”
The better question is, “Can the agent be manipulated into doing something it was never meant to do?”
In the agentic era, the attack surface is the tool-graph.
The Vulnerability of the Tool-Graph
Traditional applications usually follow deterministic paths - a user action maps to an API call, and the API call maps to a backend function. Security teams can test authentication, authorization, input validation, logging, and response handling around those known paths.
Agentic systems behave differently.
An MCP-connected agent interprets intent, reads context, selects tools, generates parameters, evaluates tool responses, and decides the next step. That decision chain can change based on retrieved documents, tool metadata, prior conversation, user prompts, or external data.
This creates a new class of failure: the agent may follow a harmful trajectory while every individual step appears legitimate.
Recent MCP research has made this risk concrete. Tool poisoning attacks show how malicious instructions can be hidden inside tool descriptions or metadata. These instructions may be invisible to the user but visible to the model, influencing which tool the agent selects and how it uses it. Microsoft has also highlighted indirect prompt injection risks in MCP, where untrusted content can manipulate an agent through the context it consumes.
Cloud Security Alliance has pointed to real-world incidents such as prompt injection against GitHub MCP workflows, unauthenticated remote code execution in Anthropic’s MCP Inspector developer tool, and exposed MCP servers operating without strong authentication. These are not theoretical concerns. They show that MCP is already becoming a practical attack surface.
These attacks are not just jailbreaks. They are workflow-level exploits.
The attacker does not need to break the model directly. They only need to redirect the agent’s reasoning path.
Why Traditional VAPT Falls Short
Standard Vulnerability Assessment and Penetration Testing is still necessary, but it is not enough for MCP-enabled systems.
Traditional VAPT is designed to find static and repeatable issues: SQL injection, cross-site scripting, broken authentication, exposed secrets, insecure headers, and misconfigured APIs. These checks matter, but they do not fully capture agentic risk.
Agentic vulnerabilities often emerge over multiple steps.
An agent may start with a safe instruction. It may use an approved tool. It may operate under a valid identity. But after reading a poisoned document, ticket, email, repository file, or tool response, it may begin following an unsafe path. It may retrieve sensitive data, summarize restricted information, trigger a write-action tool, create a token, update a record, or pass hidden parameters into another system.
The endpoint may look secure. The API may behave correctly. The tool call may be valid.
The vulnerability lives in the chain.
This is why OWASP’s agentic security work emphasizes risks such as tool misuse, identity and privilege abuse, and excessive agency. The failure is not always a broken API. Sometimes the failure is giving an agent too much autonomy, too much context, or too much permission without enough runtime control.
Securing Agent Trajectories
Prompt guardrails are not enough. MCP security requires trajectory-level defense.
Security teams need visibility into how an agent behaves across the full workflow: prompt, retrieval, tool discovery, tool selection, parameter generation, tool execution, response interpretation, and final action.
This starts with mapping the tool-graph. Which tools can the agent access? Which tools can read sensitive data? Which tools can perform write actions? Which tools can be chained together? Can one tool’s output influence another tool’s input? Can untrusted content change the agent’s behavior? Can the agent distinguish trusted system instructions from malicious external text?
Security also requires least privilege. Agents should not receive broad tool access simply because the user has broad access. Tool permissions must be scoped by task, identity, environment, data sensitivity, and risk level.
Some controls must be deterministic: block production secrets, restrict destructive actions, require approval for high-risk operations, validate parameters, isolate tool execution, and maintain audit logs.
Other controls must be contextual: detect suspicious intent, abnormal tool sequences, data exfiltration patterns, hidden instructions, privilege escalation, and unsafe reasoning paths.
A secure agentic system needs both.
Toward a Self-Healing Defense
To secure these complex integrations, organizations must move beyond static guardrails. The future of agentic security lies in continuous, workflow-aware red teaming. By mapping out the entire tool-graph before deployment, developers can identify where an agent might deviate from its intended path.
dwaar’s approach emphasizes that the security of an agent is found in its trajectories, not just its prompts. This requires a dual-layered strategy:
Adversarial Mapping (dForge): Before an agent goes live, it must be subjected to “black-box” red teaming that simulates multi-turn attacks. This process identifies vulnerabilities across the complete autonomous workflow, from tool calls to retrieval systems, ensuring that “agent privilege escalation” is caught before it can be exploited.
Autonomous Intervention (dFence): Because agents are non-deterministic, runtime protection is a necessity. When a live agent begins to exhibit “risky behavior”—such as attempting to leak production data or execute unauthorized code—the system must be capable of intervening autonomously to resolve the risk in real-time.
By combining hard deterministic rules with contextual AI judges, organizations can finally create a “self-healing” security posture that understands the intent behind every tool call. In the era of the tool-graph, the goal isn’t just to stop the attack; it’s to ensure the agent stays on the right trajectory.
The New Security Boundary
MCP is becoming a core layer of the agentic AI stack. It gives agents the ability to act across enterprise systems, but it also shifts the security boundary from the prompt to the workflow.
The next generation of AI security will not be defined by prompt filters alone. It will be defined by tool governance, identity-aware execution, adversarial testing, runtime monitoring, and trajectory-level defense.
In the MCP era, the goal is not just to secure what the agent says.
The goal is to secure what the agent does.