Securing AI Agents — MCP, Agentjacking & the New Attack Surface (2026)

WEBVTT
00:00:00.430 --> 00:00:04.330
In June 2026, three researchers took over AI
00:00:04.330 --> 00:00:08.369
coding agents, Claude Code, Cursor, Codex, without
00:00:08.369 --> 00:00:11.390
phishing anyone, without malware, without ever
00:00:11.390 --> 00:00:13.929
touching a target's machine. All they needed
00:00:13.929 --> 00:00:16.370
was a public credential developers paste into
00:00:16.370 --> 00:00:19.769
their own apps. It worked 85 % of the time. The
00:00:19.769 --> 00:00:23.250
vendor's response, quote, technically not defensible.
00:00:23.769 --> 00:00:26.230
We're not fixing it. Welcome to the new attack
00:00:26.230 --> 00:00:28.789
surface nobody secured. This is tech updates.
00:00:29.309 --> 00:00:32.159
Let's back up. The thing connecting all your
00:00:32.159 --> 00:00:34.759
AI agents to your tools is a standard called
00:00:34.759 --> 00:00:38.979
MCP, the Model Context Protocol. Think of it
00:00:38.979 --> 00:00:43.840
as USBC for AI, one universal connector so any
00:00:43.840 --> 00:00:47.280
model can plug into any tool, any database, any
00:00:47.280 --> 00:00:50.439
service. Anthropic launched it in late 2024,
00:00:51.119 --> 00:00:53.859
and within a year, OpenAI, Google, and Microsoft
00:00:53.859 --> 00:00:57.380
all adopted it. It's genuinely useful. It's why
00:00:57.380 --> 00:00:59.759
your agent can read your tickets, query your
00:00:59.759 --> 00:01:03.000
database, and open pull requests. It's also a
00:01:03.000 --> 00:01:05.579
fresh internet -facing doorway into your systems
00:01:05.579 --> 00:01:08.459
that most teams stood up in a weekend without
00:01:08.459 --> 00:01:11.079
a security review. Here's how bad the hygiene
00:01:11.079 --> 00:01:13.819
is. Researchers at Gnostic scanned the public
00:01:13.819 --> 00:01:17.140
internet for MCP servers, found over 1 ,800,
00:01:17.400 --> 00:01:20.579
and manually checked a sample. Every single one
00:01:20.579 --> 00:01:24.290
they verified, 100 % handed over its full list
00:01:24.290 --> 00:01:27.450
of tools to anyone who asked. No password, no
00:01:27.450 --> 00:01:31.069
authentication. By early 2026, other researchers
00:01:31.069 --> 00:01:34.069
were reporting more than 8 ,000 exposed servers.
00:01:34.590 --> 00:01:37.950
The reason is almost funny. The early MCP spec
00:01:37.950 --> 00:01:41.170
didn't require authentication, and the default
00:01:41.170 --> 00:01:43.810
config binds the admin panel to every network
00:01:43.810 --> 00:01:47.049
interface public from the first second it's deployed.
00:01:47.310 --> 00:01:50.750
Which brings us back to that opening attack It's
00:01:50.750 --> 00:01:53.469
called agent jacking found by a team at tenant
00:01:53.469 --> 00:01:57.950
security the trick a century DSN a write -only
00:01:57.950 --> 00:02:01.049
credential developers literally embed in public
00:02:01.049 --> 00:02:04.790
web pages Let attackers inject fake error messages
00:02:04.790 --> 00:02:09.090
into the logs and AI agent reads The agent couldn't
00:02:09.090 --> 00:02:12.150
tell a poison log from a real one and ran the
00:02:12.150 --> 00:02:14.789
attackers commands with the developers own privileges
00:02:15.890 --> 00:02:18.990
2300 plus organizations had injectable credentials
00:02:18.990 --> 00:02:21.830
sitting in the open. Every step looked legitimate,
00:02:22.210 --> 00:02:24.909
which is exactly why nothing caught it. And the
00:02:24.909 --> 00:02:27.330
vendor declined to fix it. They filtered one
00:02:27.330 --> 00:02:29.669
specific payload string and called it a day.
00:02:30.250 --> 00:02:33.050
Agent jacking isn't a one -off. It's a pattern.
00:02:33.430 --> 00:02:37.069
Layer one, prompt injection, which OWASP now
00:02:37.069 --> 00:02:40.110
ranks as the number one risk to AI applications,
00:02:40.389 --> 00:02:43.060
two editions running. The model can't tell your
00:02:43.060 --> 00:02:45.360
instructions from an attacker's, because they
00:02:45.360 --> 00:02:49.120
ride the same channel. Layer 2. Indirect injection.
00:02:49.539 --> 00:02:53.439
Hide the instructions in a webpage, a PDF, a
00:02:53.439 --> 00:02:56.879
support ticket, an error log, anything the agent
00:02:56.879 --> 00:03:01.319
reads later. Layer 3. The agent ecosystem itself.
00:03:01.780 --> 00:03:04.520
Last winter, thousands of hobby AI agents leaked
00:03:04.520 --> 00:03:06.620
their credentials and chat histories through
00:03:06.620 --> 00:03:09.939
exposed MCP endpoints, and the wake -up call
00:03:09.939 --> 00:03:14.180
was a year ago. At Black Hat 2025, researchers
00:03:14.180 --> 00:03:17.159
showed zero -click attacks pulling entire CRM
00:03:17.159 --> 00:03:20.199
databases out of copilot and Salesforce agents.
00:03:20.819 --> 00:03:23.620
One stat before we move on. Cisco's State of
00:03:23.620 --> 00:03:26.840
AI Security report this year found that 83 %
00:03:26.840 --> 00:03:30.180
of organizations are deploying agentic AI into
00:03:30.180 --> 00:03:33.860
their business. Only 29 % feel ready to secure
00:03:33.860 --> 00:03:37.759
it. Sit with that for a second. That 54 -point
00:03:37.759 --> 00:03:40.629
gap between what we're shipping and what we can
00:03:40.629 --> 00:03:44.189
defend isn't a statistic. It's the attack surface.
00:03:44.629 --> 00:03:48.009
We wired agents into email, code, payments, and
00:03:48.009 --> 00:03:51.050
customer data faster than any technology in history
00:03:51.050 --> 00:03:53.949
and we did it before writing the security playbook.
00:03:54.270 --> 00:03:57.930
So what do you actually do? Four moves. One,
00:03:58.129 --> 00:04:01.409
lease privilege. Scope every agent and every
00:04:01.409 --> 00:04:04.969
tool to the minimum it needs because an over
00:04:04.969 --> 00:04:07.349
-permissioned agent is a breach waiting for a
00:04:07.349 --> 00:04:11.840
prompt. 2. Sandbox the agent's execution and
00:04:11.840 --> 00:04:14.639
put a human in the loop for anything high risk.
00:04:15.080 --> 00:04:20.040
Refunds, deletes, deploys. 3. Put a gateway in
00:04:20.040 --> 00:04:23.980
front of MCP. Broker the traffic. Require authentication.
00:04:24.519 --> 00:04:26.699
Stop broadcasting your tool list to the world.
00:04:27.279 --> 00:04:30.360
4. Treat every agent credential as a non -human
00:04:30.360 --> 00:04:33.680
identity. Inventory it. Scope it. Rotate it.
00:04:33.839 --> 00:04:37.629
Revoke it. We did a whole episode on NHIs. Your
00:04:37.629 --> 00:04:39.990
agents are the fastest growing population of
00:04:39.990 --> 00:04:42.889
them. Let's translate the vendor pitch. They
00:04:42.889 --> 00:04:46.430
say, autonomous agents that run your business.
00:04:46.750 --> 00:04:49.810
Reality, autonomous agents that will also run
00:04:49.810 --> 00:04:52.509
an attacker's business if you let them. They
00:04:52.509 --> 00:04:57.509
say, MCP connects everything. Reality, yes, including
00:04:57.509 --> 00:05:00.629
the parts you didn't mean to expose. They say,
00:05:01.009 --> 00:05:04.649
AI native security built in. Reality, the number
00:05:04.649 --> 00:05:07.769
one AI risk is a sentence an attacker hides in
00:05:07.769 --> 00:05:10.589
a support ticket, and most products still can't
00:05:10.589 --> 00:05:13.670
reliably stop it. The agents are real and genuinely
00:05:13.670 --> 00:05:17.009
useful, the security is a year behind the adoption,
00:05:17.670 --> 00:05:20.230
and the gap is where you'll get hit. Here's the
00:05:20.230 --> 00:05:23.879
close. Every previous platform shift, Cloud,
00:05:24.180 --> 00:05:28.060
mobile, APIs. We secured years after we adopted
00:05:28.060 --> 00:05:30.860
it and paid for the lag and breaches. Agents
00:05:30.860 --> 00:05:34.240
are the same story at 10 times the speed. The
00:05:34.240 --> 00:05:36.540
companies that win the next two years won't be
00:05:36.540 --> 00:05:39.079
the ones with the most agents. They'll be the
00:05:39.079 --> 00:05:41.560
ones who scoped them before something else did.
00:05:42.040 --> 00:05:44.959
That's the show. Forward it to whoever just gave
00:05:44.959 --> 00:05:48.519
an AI agent access to production. Next week,
00:05:48.939 --> 00:05:52.000
Wi -Fi 7 and whether the AI ready branch is real
00:05:52.000 --> 00:05:55.360
or just a radio with a chatbot bolted on. This
00:05:55.360 --> 00:05:57.319
is Tech Updates. Stay sharp.