How MCP servers expose enterprise secrets to AI agents — and why it's hard to catch

The Model Context Protocol (MCP) servers, which act as intermediaries between AI agents and enterprise systems, can silently expose corporate secrets through plaintext configuration files, over-permissioned access, and prompt injection attacks. Security teams often remain unaware that an MCP server is running until after a breach has occurred.

MCP is an open standard originally introduced by Anthropic. It allows AI assistants to connect to external tools and live data sources — pulling records from a database, opening a file, or calling an API — rather than being limited to the model's pre-existing knowledge. The key component is the MCP server: a small program that sits between the AI agent and the system it wants to use, exposing only the specific actions the agent is permitted to perform.

However, this intermediary role creates a significant security risk. To act on a system, an MCP server must hold that system's credentials: service account keys, API tokens, passwords, and other secrets. If the server is configured insecurely — for example, storing credentials in plaintext configuration files, granting excessive permissions, or being vulnerable to prompt injection — an attacker can gain access to critical infrastructure, internal documentation, and cloud services.

As more organizations adopt AI agents into their workflows, the risk of such exposure grows. The problem is compounded by the fact that MCP servers often operate without centralized oversight, making it difficult for security teams to detect misconfigurations or unauthorized access in real time. Prompt injection, in particular, can trick an AI agent into revealing secrets it has access to, even if the server itself is otherwise secure.

The authors recommend that every organization now question what secrets they are handing to AI and how well those secrets are protected once they reach an MCP server. Agents are no longer just generating text — they have direct access to live systems, and every misconfiguration in that access can become an entry point for an attack. Key mitigation steps include encrypting credentials at rest and in transit, implementing the principle of least privilege, conducting regular audits of MCP server configurations, and monitoring for prompt injection attempts.