Lightning Talk: MCP Under Attack: Securing Control Plane

Why It Matters

Without hardened MCP controls, enterprises expose a new, high‑value attack surface that can be leveraged by adversaries to hijack privileged AI actions, jeopardizing data integrity and operational continuity.

Key Takeaways

• AI agents now receive unrestricted MCP access, creating new attack vectors.
• Delegating trust without external policy leads to unverifiable actions.
• Traditional content filters insufficient; control‑flow integrity is essential.
• Hardening steps: externalize policy executor and enable full logging.
• Privilege escalation via AI‑mediated tool calls threatens enterprise security.

Summary

The talk warns that the Model Context Protocol (MCP), the standardized plumbing that lets AI agents run tools, access data and execute code, is being deployed without a security policy, turning it into a privileged access point.

Because MCP delegates trust directly to the language model, any weakness in tool contracts or policy enforcement creates an unchecked execution path. The speaker observed that after deploying an MCP server, the model behaved as instructed, yet there was no way to verify that the chosen arguments or tool calls were safe, exposing a systemic risk.

He recounted a client deployment where, three weeks later, the lack of audit logs meant he could not prove the model did nothing malicious. He also highlighted that most firms rely on simple content filters—blocking bad words—while the real threat lies in control‑flow integrity and unauthorized privilege escalation via AI‑mediated actions.

The remedy is to externalize policy enforcement, run a separate policy executor outside the model, and enforce full, immutable logging. Organizations that ignore these steps risk breaches that bypass traditional perimeter defenses and could lead to costly data exfiltration or infrastructure compromise.

Original Description

MCP Under Attack: Securing the New Trusted Control Plane

🎙️ Yevhen Pervushyn, Founder & Security Researcher, Red Asgard

📍 Presented at SANS AI Cybersecurity Summit 2026

Problem: AI agents are standardizing """"USB-like"""" access to enterprise data via unauthenticated MCP servers.

Solution: A red-team methodology for """"Context Manipulation"""" that treats AI intent as a trusted input to privileged systems.

Next: Why the future of AI security is about control-flow integrity, not just content filtering.

Explore upcoming SANS Summits to continue learning from leading voices in cybersecurity: https://go.sans.org/summits