AIdentity’s Answer to MCP Server Incidents

In 2025, the deployment of AI agents transitioned from experimental phases to production workloads, with these autonomous systems performing tasks such as scheduling, coding, and business decision-making at machine speed. The Model Context Protocol (MCP), developed by Anthropic and adopted by companies like OpenAI and Google, has become the standard for these agents to interact with enterprise data, facilitating a streamlined connection to tools without needing custom integration. However, this widespread deployment has outpaced security measures, leading to significant vulnerabilities and incidents. Examples include malicious MCP servers exfiltrating email data and vulnerabilities that allow remote code execution, illustrating the critical need for adapting security frameworks. Traditional Identity and Access Management (IAM) approaches are inadequate due to their human-centric design and cannot address the dynamic permissions and speed required by AI agents. This evolution necessitates the concept of AIdentity, which extends IAM principles to autonomously operating entities. It includes monitoring agent behavior and identity management across multiple systems to prevent misuse and ensure security. Organizations should leverage Identity Security Posture Management (ISPM), adapting it for AI agents to provide continuous discovery, risk assessments, and policy enforcement. This also involves managing the identity of agents, servers, tools, users, and data to ensure a secure working environment. MCP's architecture and its inherent attack vectors, such as server-to-client attacks, tool poisoning, and supply chain compromises, highlight the need for rethinking identity management and implementing robust security controls.

• In September 2025, the first confirmed malicious MCP server was uncovered, exfiltrating processed emails while masquerading as a legitimate service.
• A disclosed vulnerability (CVE-2025-6514) with a CVSS score of 9.6 allows remote code execution by exploiting client vulnerabilities through MCP servers.
• 91% of organizations utilize AI agents, yet merely 10% have formal security policies governing their use.
• Anti-patterns of traditional IAM frameworks, such as static permission allocation, have been inadequately equipped to manage AI agents' dynamic needs.
• Identity security initiatives for AI agents must expand beyond traditional user-based approaches, addressing agent, server, tool, and data-level identities.
• Trust boundaries traditionally assumed in security frameworks are reversed in MCP, as agents inherently trust the potentially hostile MCP server environments.
• AI-specific telemetry that recognizes behavioral patterns of agents is necessary for timely and accurate detection of unusual activities.
• Prompt injection vulnerabilities exploit the reliance of agents on MCP-derived data, potentially manipulating agent operations.
• Supply chain attacks, particularly concerning community-developed servers and tools, remain a significant security challenge.
• Discovery of shadow AI agents, deployed without security review, poses a substantial risk due to their unrestricted potential impact.

• "Trust assumptions create opportunities for attackers. Securing MCP requires rethinking where trust boundaries lie."
• "Behavioral approaches start with understanding normal patterns of agent behavior. Without these baselines, distinguishing legitimate from malicious activity becomes impossible."
• "You cannot govern what you cannot see. Discovery must happen continuously as new agents appear."
• "Organizations lack visibility into how many agents are running, what they can access, or what they are actually doing."
• "Stale credentials represent agents that haven't rotated credentials according to policy."
• "Traditional monitoring missed these attacks because they appeared to be legitimate operations. Security teams need AI-specific telemetry."
• "CVE-2025-6514 demonstrated that malicious MCP servers can exploit client vulnerabilities to achieve code execution."
• "Agent sessions should expire based on task duration rather than persist indefinitely like many service accounts."
• "AI agents operate at machine speed, but reasonable operational patterns still exist."
• "Discovery needs to identify MCP clients, both official and community servers installed by developers."