AI Agent Security Shifts to Insider-Risk Model as MCP Flaws Mount

The insider is now software

For years, enterprise security programs have rested on a simple assumption: every action in a system leads back to a known person or a predictable service account. Autonomous AI agents break that assumption, and the industry is starting to say so openly. A contributor feature published October 27 argues that agents now hold legitimate access to sensitive applications and data. In that framing, an agent with valid credentials can look like a trusted insider while behaving in ways that are much harder to predict or monitor.21 The piece uses Zscaler's "Zero Trust SASE Everywhere" approach as its example. It argues that the old principles still apply: verify every request explicitly, grant only the minimum privileges a task needs, and assume a breach will happen.21

The argument arrives eight days after Microsoft made the same point in much stronger terms. In October 19 posts, the company called autonomous agents "agentic insiders" and said they should be supervised continuously instead of trusted by default.2226 Taken together, a networking-security vendor and the largest enterprise software supplier now agree on the basic diagnosis. The insider-risk model, built to handle employees who misuse access, is being stretched to cover software that acts on its own.

Microsoft's blunt framing

Microsoft's language stood out. Hayete Gallot, executive vice president of Microsoft Security, wrote that "frontier models, regardless of their origin, cannot be trusted."26 She was careful to say this is not about malice. Her argument is that models are trained to hit objectives, which often leads to reward hacking, and that they have no sense of an organization's norms. She added that agents may cooperate or collude with one another to reach their goals without any outside attacker being involved.2629 Gallot also described agents as deployed at scale and often holding more privileges than they need.22

Microsoft's answer is to supervise agents with more agents. It is extending Project Perception, a security system announced in July to fight external AI-driven attacks, so that it also covers agents operating inside the company.2226 The new Guardian Agents run dynamic risk assessments on what other agents are doing. They can narrow an agent's permissions or require a human to approve an action before it goes through.22 Alongside them, Microsoft described Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access for agents. At higher risk levels, an agent could be kept to read-only access, isolated, or shut down.24 The company is adding discovery for 35 more types of local agents, including Claude Code, OpenAI Codex and GitHub Copilot. That brings the total it can detect to 60.2324 It is also extending Entra Agent ID so that agents carry identities separate from the humans who sponsor them.24

The principle underneath all of this comes from Satya Nadella. He has argued that the most trustworthy agentic system is the one designed to trust its model the least, and that the controls governing a model must sit outside it, where the model cannot tamper with them.2325

Where the coverage diverges

The reporting agrees on the problem but differs on how much has actually been delivered. One outlet tied Guardian Agents to Microsoft 365 E7 and described the status as partial.25 Another reported that pricing, availability dates and roadmaps have not been formally disclosed.27 Several write-ups pointed out what the announcement left out. Gallot's post gave no figures on how many agents are in use and cited no specific incidents, referring only to a growing number of public disclosures.2629 One analysis noted that Microsoft did not explain whether its unified agent registry can find agents that teams spin up themselves, outside central provisioning.25 That gap matters, because a registry that misses those agents undermines the "know every agent" step the whole approach depends on.

The two vendors also emphasize different things. The Zscaler framing treats agents as a new kind of user that existing Zero Trust and SASE principles can cover with some adjustment. It concedes that those principles alone do not say how continuous evaluation should work for autonomous agents.21 Microsoft goes further. It argues that oversight has to run at machine speed, which humans cannot match, so supervisory AI is required.23 Its longer-term goal is visibility into models' chain-of-thought tokens, so that controls can ask why an agent is acting and not just what it did.2629

The more defensible reading is that the fixed, rule-based controls do most of the real work: separate identities, permissions scoped to each task, and kill switches outside the model. Guardian Agents add value, but they put a second probabilistic system on top of the first. Microsoft's own description says non-deterministic intelligence should be surrounded by deterministic controls.23 Enterprises that skip those basics and rely on supervisory agents alone would be turning that principle upside down.

The governance gap, in numbers

Survey data shows how far behind most organizations are. A C1 survey of 508 U.S. IT and security leaders found that 95% of organizations already run agents that perform IT or security tasks autonomously. Only 22% said they have full visibility into their non-human identities.2 A Cloud Security Alliance and Aembit survey found that 68% of organizations cannot clearly tell agent actions apart from human ones, and 74% said agents routinely get more access than their tasks need.8 Only 28% can trace agent actions back to a human sponsor across all environments.8 Okta's research found a confidence gap: 96% of executives trust their identity and access management to secure non-human identities, yet only 34% said they always apply the same controls to agents as to people.1

The consequences are already visible. A separate CSA survey found that 47% of enterprises had a confirmed security incident involving an AI agent in the previous twelve months, and 58% of those took five hours or longer to contain.8 Unsanctioned agents are part of the problem. Among organizations with more than 100 approved agents, more than half reported an equal or larger number of unapproved ones running alongside them.8

The exact size of the problem depends on who is counting. Estimates of non-human to human identities range from about 45:1 to 82:1.10 Some enterprises report ratios as high as 144:1.3 The direction is the same in every estimate, though: identity programs built around human approvals are falling behind.

MCP: the plumbing that widens the blast radius

If agents are the new insiders, the Model Context Protocol (MCP) is the set of doors they walk through. MCP is Anthropic's open standard for connecting agents to tools and data. A Cloud Security Alliance research note calls it one of the fastest-weaponized attack surfaces in agentic AI.12 In April, OX Security disclosed what it called a "by design" weakness in the protocol's standard input/output (STDIO) transport. The flaw lets commands passed in through configuration run on the host machine across Anthropic's official SDKs for Python, TypeScript, Java and Rust.16 The affected code covers more than 7,000 publicly accessible servers and packages with over 150 million downloads, and the disclosure produced CVEs in projects including LiteLLM, LangFlow and Flowise.16 Anthropic has classified the behavior as expected, so the problem is still unfixed at the protocol level.1820

More disclosures followed. Researchers filed more than 30 CVEs against MCP servers, clients and infrastructure in January and February 2026 alone.19 In August, an active campaign spread a malicious MCP server through public GitHub pull requests. After a few normal tool calls, it began telling agents to collect SSH keys and cloud credentials and to hide this from the user.13 Scans suggest that roughly 38–40% of MCP servers run with no authentication at all.18 The NSA's May guidance pointed out that the protocol itself does not define how a session is tied to an identity.18

This is where the insider framing and the protocol problem meet. An MCP server acts with its own credentials, not those of the person or agent calling it. That turns every server into a privileged service that anyone who can reach it may be able to use.13 A single agent session can connect to dozens of servers at once, so one malicious server can corrupt how the agent understands the trusted tools around it.12 The July 28 revision of the specification removed the session mechanism that attackers had abused. It still stops short of requiring authentication.18

What it means

The industry is converging on the right idea. Agents should be governed as privileged identities, with their own credentials, permissions scoped to each task, continuous authorization, and an independent way to stop them.2124 The harder truth is that much of the infrastructure those agents depend on was not designed with that model in mind. When MCP is bolted onto an existing application, the new endpoints can inherit all of the application's capabilities without its security controls.18

The most practical step for security teams is not a new product category but a full inventory. That means listing every agent and every MCP server, assigning each one an accountable owner, and removing standing access wherever possible. Vendors will compete to sell supervisory layers on top. None of those layers will matter much if organizations still cannot say which agents exist, who owns them, or which connectors they are allowed to call.