AI Agent Governance Shifts to Runtime Control as MCP Risks Mount

Oversight now leads the AI agent story

For most of the past two years, news about AI agents was mostly news about what they could do. In the first week of November 2026 the coverage turned to how they could be stopped. Within a few days, Citrix, Ebix, Snowflake, CrowdStrike and others announced products that are mainly about watching, limiting and auditing autonomous software, not making it more capable.246 In a regulatory filing, Apple listed agents that act in "unintended or unpredictable ways" as a business risk. Banking regulators also published new supervisory material on agentic AI.109

This is a change of direction, not a passing mood. Agents now run in production, the protocols connecting them have matured, and security teams have collected enough incidents to make governance the main issue for enterprise buyers.

What happened: a wave of control layers

ServiceNow's mid-October announcement set the pattern. Its AI Passport is a cryptographically signed credential that agents check at runtime to confirm what they are authorized to do. It covers both AI agents and Model Context Protocol (MCP) servers at each step of a multi-agent workflow.1 When an agent goes beyond its scope, the system can respond in stages, from redirecting it up to a kill switch. NVIDIA is building the enforcement implementation on its OpenShell runtime.1 ServiceNow calls this a move from reaction to prevention. The point is that audit trails show what already happened, while runtime authorization is supposed to stop the action before it occurs.1

Citrix used similar language on November 4. Its SecurAccess product will become a policy checkpoint that limits agents to the tools and actions a specific task needs through MCP, not everything the assigning employee can access. In Citrix's example, an agent looking into a disputed supplier payment can read the records but cannot approve or change the payment.2 Citrix also plans to detect when automation, not a person, is driving browser activity. It cited a Deloitte finding that only 21% of enterprises have mature governance for agentic AI.2

The same week, Ebix and intentyx launched SMARE, a behavioral platform for regulated industries. It compares agent activity against each agent's approved "Design Intent" and flags drift.4 CrowdStrike agreed to acquire Fiddler to add agent observability to Falcon, and Island extended its enterprise browser controls to agents.6 Veylan entered the market on November 5 with a governance-heavy "enterprise AI harness" that sets which tools agents can use and when a human has to approve an action.8

The customer side shows how big the problem has become. One ServiceNow customer, LTM, says it has deployed 1,500 agents, and each one has an employee ID and a human manager.1

Why it matters: protocols connect agents but don't govern them

The timing makes sense given what happened to the plumbing underneath. Anthropic's MCP, which connects agents to tools and data, and Google's Agent2Agent (A2A) protocol, which lets agents hand tasks to each other, are now both hosted at the Linux Foundation's Agentic AI Foundation (AAIF).20 A2A joined MCP there in August, along with Block's goose runtime and OpenAI's AGENTS.md convention.20

Coverage of that move differs on what it meant. One explainer called it the moment when the risk of depending on a competitor's protocol "was formally eliminated."18 Forbes was more careful. It noted that Google had already given A2A to a Linux Foundation project in June 2025, so the August move changed where the work is hosted, not who controls it.20 The Forbes reading is the more accurate one. Neutral governance was already in place, and the August move made it tidier.

Adoption figures are large, though they don't always agree. The Linux Foundation reported in April that more than 150 organizations support A2A, with integrations across Google, Microsoft and AWS.11 Forbes points out that these numbers come from the foundation and its vendors, not from independent measurement.20 Even basic version details vary. Some guides describe v1.0 as the current stable spec, while one says v1.2 arrived in March.1914 For MCP, one tally counts more than 47,000 active servers in the official registry and about 232 million npm downloads of the TypeScript SDK in September alone. Anthropic's last official count, from December 2025, was 10,000 or more public servers.25

The key point is one that several analyses make: neither protocol decides who may do what. MCP authenticates a client to a server, and an authorized client can see everything that server exposes. A2A describes agents but does not decide whether the agent on the other end should be trusted.13 The MCP specification says outright that it cannot enforce security principles such as consent at the protocol level and leaves that to implementers.26 Products like AI Passport and Citrix's MCP checkpoint are moving into that gap.

MCP has become the main attack surface

If A2A is how agents coordinate, MCP is where they reach real systems, and the security record there is worrying. One count finds 382 CVE records mentioning MCP in the National Vulnerability Database as of October 21. Of those, 324 were published in 2026, and 79 are rated Critical.25 A researcher who scanned 514 publicly reachable MCP servers found that 195, or 38%, exposed tools with no authentication. The same researcher said maintainers sometimes never responded to vulnerability reports.23

The incidents are concrete. Pillar Security reports an August campaign in which a malicious server called "productivity-suite" behaved normally for three tool calls. It then instructed agents to find SSH keys and cloud credentials and to hide this from the user.22 Pillar also disclosed authentication bypasses in Dolt and Grafana MCP servers that let unauthenticated callers run tools with the server's own credentials.22 Separately, researchers published advisories against frameworks including LangGraph, Strands Agents SDK and FastMCP. The flaws allowed crossing session boundaries and bypassing authorization.3

The protocol has responded. The July 28, 2026 revision made MCP stateless and removed the session-ID mechanism that the Dolt and Grafana attacks abused. It also added issuer validation to block OAuth mix-up attacks.2122 The NSA had warned in May that MCP's "rapid proliferation has outpaced the development of its security model."21 Pillar is clear that the new spec does not stop tool poisoning, malicious packages or prompt injection through tool results, and older servers keep their old behavior until they are updated.22 Some figures are less alarming. One study found that fewer than half of sampled scanner alerts held up on manual review, and that 95% of commercially hosted remote servers in one sample enforced OAuth 2.1 with PKCE.25 Overall, the problem is real but uneven. It is worst in hobbyist and self-hosted servers, and it is showing up in enterprises through shadow deployments that security teams don't know about.22

Visibility isn't the same as control

The most useful disagreement in the coverage is about whether these new tools actually enforce anything. Vendor announcements stress control. BigDATAwire is more doubtful. It notes that being able to see what an agent does doesn't mean you can stop it, and that it remains unclear who is responsible when agents move between platforms.5 It describes Dataiku, Snowflake, Databricks, Cloudera and NVIDIA all building overlapping control layers.5 That suggests a crowded market and not yet a clear standard.

That skepticism explains why products are moving toward runtime enforcement: signed credentials, sandboxed execution and policy checkpoints that sit inline. ServiceNow says its passport is built on open specifications so other identity providers can issue and verify credentials.1 Whether competitors adopt it is an open question. Gartner's first Magic Quadrant for AI agent management platforms, which names Microsoft a Leader, shows the category is now formally recognized. One security firm predicts auditors will start asking for agent inventories within 12 to 18 months.7

Regulators and liability

The pressure isn't only commercial. The OCC's new framework gives examiners agentic-AI considerations to add to existing model-risk and operational-risk reviews. The agency says the framework sets no enforceable standards.9 Ebix cites reports that major US banks found unauthorized third-party agents operating inside customer accounts.4 Bank of America has reportedly warned customers that giving banking passwords to AI agents voids fraud protection.3 Delaware, meanwhile, is considering a corporate form that would let agents run a business while protecting human funders from liability, a proposal that has drawn objections from Congress.3

The takeaway

The coverage points to one conclusion. Connecting agents is now largely handled through open standards under neutral governance. Controlling them is the open problem, and it is attracting most of the investment. MCP and A2A will keep expanding what agents can reach. For the next year, the companies that matter will be the ones that can show at runtime, with evidence an auditor accepts, that a given agent was allowed to take a given action. Apple's warning that its ability to oversee third-party agents "may be limited" is a fair summary of where most enterprises stand now.10