AI
From Assistants to Agents: The Attack Surface Grows
The copilot era used natural language processing, RAG, and backend API calls to answer user queries. By August 2025, AI agents and MCP servers deploy at speed, connecting to more data than copilots ever touched. That expansion is the core problem. Prompt injection, misconfigured tools, credential leaking, and arbitrary code execution all existed before. Agents amplify each one: they persist state across sessions, invoke external tools dynamically, and can act without human interaction.
Why MCP Expands the Attack Surface
MCP standardizes how LLMs interact with external tools, sitting between an LLM host and tools like file systems, web search, and email senders. Every tool plugged in was built before AI existed. They carry different RBAC systems and different auth stacks, all feeding into one control plane that makes tool selection decisions. Without security at the protocol level, vulnerabilities propagate across entire agent fleets. Plugging unvetted third-party tools into a dynamic code execution engine means trusting something you picked up at random.
Three Risks Unique to LLM Systems
The OWASP Top 10 for web apps and the OWASP Top 10 for LLMs share most of their list. Only three risks are genuinely new: system prompt leakage, vector and embedding weaknesses, and misinformation. System prompt leakage exposes guardrails, authentication tokens, or internal instructions. Attackers can impersonate agents and break audit trails. Embedding attacks let adversaries poison vector stores and bypass security controls without obvious signs. Misinformation compounds in agentic chains: one wrong answer passes downstream, and persistent memory makes each reload a potential re-attack.
How Agents Amplify Trust Boundary Failures
Threat modeling a payroll agent reveals three scenarios. The agent chain runs from user input through an agent host and LLM, through MCP client and server, to endpoints that query pay slips, update salaries, and generate reports. Prompt injection can enter through tool descriptions or return in unsanitized tool output. LLMs implicitly trust what comes back from MCP clients. A real GitHub incident put the model in practice: users tricked an MCP-backed agent into retrieving private repository data they had no authorization to see.
Practical Defenses for High-Stakes AI
Skip the chat interface unless you need it. Chat opens prompt injection vectors by design; removing it eliminates threat categories from the ground up. For anything high-stakes, build your own MCP client. Owning that layer lets you transmit user identity across the AI boundary, control tool selection, and avoid misconfigured clients pointing at arbitrary servers. Segregate MCP servers by trust level. Group tools with similar permission models together. Simpler implementations are more secure ones, and this lets you achieve both.
Q&A
How do you manage a growing list of whitelisted MCP servers as the tools behind them change? Treat every agent system as a supply chain: audit MCP servers regularly, lock down where tools can come from, and apply supply chain attack thinking to every integration. ▶ 32:50
Notable Quotes
S in MCP stands for security. Um, so Andra Lezza · ▶ 7:31
you can see how this gets out of hand Jeremiah Edwards · ▶ 29:01
everything is a supply chain now. Jeremiah Edwards · ▶ 33:34
Key Takeaways
- About 75% of agentic AI security comes down to applying traditional security practices correctly.
- LLMs implicitly trust tool output from MCP clients, making unsanitized responses a direct injection vector.
- For high-stakes AI, build your own MCP client and skip chat interfaces when not required.
About the Speaker(s)
Jeremiah Edwards heads the AI business unit at Sage, where his team has deployed over 16 AI services across 8 global products, generating 20 million AI predictions daily. Before Sage, he founded data science and ML teams at organizations including FLYR Labs and Apteligent (VMware). He holds degrees in mathematics from MIT and Pierre and Marie Curie University.
Andra Lezza is a Principal Application Security Specialist at Sage with over seven years in application security. She implements DevSecOps practices, conducts security assessments, and develops secure coding guidelines for AI and ML teams. She has co-led the OWASP London Chapter since 2019.