The NSA, in collaboration with Carnegie Mellon’s SEI, released formal guidance on securing Model Context Protocol (MCP) which amounts to the de facto standard for connecting AI agents to enterprise tools and data. The verdict: MCP’s adoption has outpaced its security model. The protocol doesn’t mandate authentication, RBAC, or audit logging, and real-world exploits already exist with tool parameter injection, naming-collision hijacks, and malicious servers that swap benign tool descriptions for hostile ones after installation. NSA’s recommendations read like a SOC to-do list:
define trust boundaries between agents and tools
sandbox tool execution
log every invocation with parameters and identities
scan your network for unauthorized MCP servers.
If your organization is deploying AI agents — including in the SOC itself — those agent action logs are now telemetry you’ll need to be able to question during an investigation.