Agentic AI shifts the security question from what a model says to what it does, and the Model Context Protocol is what lets it do anything. An autonomous agent that can plan, call tools, and act without a human between each step turns a one-shot prompt injection into a multi-step attack chain: hijack the goal, misuse a tool, inherit an identity, exfiltrate through the composition. OWASP made this official with its Top 10 for Agentic Applications 2026, and by every practitioner survey heading into 2026, agentic AI now sits at or near the top of the threat list, ahead of deepfakes and ransomware. This is how the chain forms, and where it breaks.
This is the third piece in our MCP security series, after the secure MCP server hardening guide and the MCP attack-surface map. Those covered the server and the protocol. This one is about the agent on top of them, because the moment a model can chain MCP tools on its own initiative, the individual weaknesses we catalogued stop being isolated and start compounding.
From “what AI says” to “what AI does”
The defining change in 2026 is autonomy. A chatbot that produces a harmful sentence is a content problem. An agent that produces a harmful sequence of tool calls is an action problem, and actions touch real systems: databases, repositories, payment APIs, infrastructure. OWASP frames its agentic top ten exactly this way, as a move from securing output to securing behaviour. The agent selects tools on the fly, composes them dynamically, and decides its own next step, which means static, pre-written policy cannot anticipate the path it will take.
MCP is the substrate that makes the autonomy consequential. It gives the agent a uniform way to reach dozens of tools at once, so a single hijacked objective can range across everything the agent is connected to. The protocol did not create agentic risk, but it is the connective tissue that turns a hijacked agent from a nuisance into an incident.
| goal hijack injected objective |
→ | tool misuse picks the wrong call |
→ | privilege abuse standing identity |
→ | chain across N MCP tools |
→ | impact act / exfil |
Goal hijacking: steering the objective, not the output
Goal hijacking is the agentic evolution of prompt injection. Instead of coaxing one bad answer, the attacker rewrites the agent’s objective, and the agent then pursues the new goal across many autonomous steps. An injected instruction in a document, a ticket, or a web page does not just produce a wrong summary; it tells a planning agent that its real task is to find and exfiltrate credentials, and the agent dutifully decomposes that into tool calls. The reach of the hijack equals the reach of the agent, which is why the same injection that was containable in a chatbot becomes severe the moment the model can act on it. We covered the injection mechanics in the defender’s playbook; agentic systems are where those mechanics get their teeth.
Tool misuse and unsafe chaining
Agents chain tools dynamically, and that dynamism is the attack surface. Static policy enforcement assumes you know which tool will be called when, but an autonomous agent decides at runtime, often selecting an API the designer never expected it to combine with another. The GitHub and Supabase incidents in our attack-surface map were exactly this: read from a privileged source, write to an attacker-visible sink, two legitimate tools chained into one exfiltration. Elastic Security Labs, in its analysis of MCP tool attacks, makes the same point: the dangerous combinations are emergent, not declared, so you cannot enumerate them in advance and must instead constrain what any chain is allowed to reach.
Identity and privilege abuse
An agent usually runs with a standing identity, a service account, a long-lived token, an OAuth grant that persists across every task. That standing authority is the prize. When the goal is hijacked, the agent does not need to escalate privileges; it already holds them, and it uses them on the attacker’s behalf. This is the structural reason least privilege matters more for agents than for almost any other component: the agent is a confused deputy by construction, acting with its own authority on instructions that may have come from anywhere. Scope the identity to the user and the task, not to the system, and a hijack inherits far less.
Memory poisoning and persistence
Agents that remember are agents that can be poisoned durably. An instruction written once into a vector store, a “preferences” field, or a long-term memory fires every time that memory is re-read, surviving session boundaries the way stored prompt injection does. In an agentic system the consequence is worse, because the poisoned memory does not just shape a reply, it can re-trigger a malicious plan on a future, unrelated task. Treat anything the agent persists as a trust boundary, and validate memory on the way in, not only on the way out.
Multi-agent blast radius
The frontier risk is composition between agents. When one agent calls another, or several share a tool fabric over MCP, a hijack in one can propagate as instructions the others treat as trusted internal coordination. There is rarely an instruction-versus-data boundary between cooperating agents, so a single poisoned input can cascade. The supply-chain dimension compounds it: a community MCP server, a shared skill, or a third-party agent pulled into the fabric inherits the trust of everything it connects to. This is where the boring advice, pin your dependencies, audit third-party tools, separate zones, stops being boring.
Containing agentic systems
You cannot make an autonomous agent un-hijackable, so containment is the strategy. Five controls do most of the work, and they map directly onto the links in Figure 1.
| 1 . human-in-the-loop on destructive actions | 2 . least-privilege, task-scoped identity |
| 3 . bounded tool surface per task | 4 . full action observability + audit |
| 5 . a kill switch: pause or revoke the agent authority on anomaly | |
The human-in-the-loop gate is the highest-value single control, because the catastrophic outcomes, moving money, deleting records, publishing data, executing code, all require a tool to actually act. A confirmation step in front of those actions removes most worst cases on its own. Task-scoped identity shrinks what a hijack inherits. A bounded tool surface, only the servers this task needs, denies the chain its reach. Action-level observability, every tool call logged with identity, arguments, and data volume, is what lets you detect the read-then-write pattern in flight. And a kill switch, the ability to pause an agent or revoke its credentials the instant something looks wrong, is the control most teams discover they need only after an incident. The build-side specifics for several of these live in the hardening guide; for organisations standing up agent fleets, the same logic argues for the kind of endpoint and response tooling in our business ransomware-protection picks, because an autonomous agent with standing credentials is, in incident-response terms, an internal actor.
What to watch over the next year
Three signals will tell you how this matures. First, signed and verifiable tool definitions, the ETDI direction, moving from research into clients by default, which would close the rug-pull and shadowing gaps at the protocol level. Second, agent-identity standards that give each agent a scoped, attestable identity instead of a borrowed service account, which is the missing piece under most privilege-abuse incidents. Third, regulation: the NSA’s 2026 MCP guidance and the OWASP agentic top ten are the early scaffolding of what will become procurement and compliance requirements, and by 2027 “did you red-team your agents” will be an audit line, not a nice-to-have. The organisations that treat agents as untrusted operators now will not have to retrofit it under deadline later.
The honest summary is the one the NSA, OWASP, and a year of incidents all converge on: agentic AI is genuinely useful and genuinely an expansion of attack surface, and the gap between deployment speed and security maturity is where the risk lives. MCP is excellent plumbing. The agent sitting on top of it should be governed like any other actor that can read your data and act on your systems, because that is exactly what it is.
FAQ
What is the difference between prompt injection and goal hijacking?
Prompt injection manipulates a single response. Goal hijacking rewrites an autonomous agent’s objective so it pursues the attacker’s aim across many self-directed tool calls. Same root cause, the model cannot separate instructions from data, but goal hijacking has the agent’s full reach behind it.
Why does MCP make agentic threats worse?
MCP gives an agent uniform access to many tools at once, so a hijacked objective can range across everything connected. It does not create the risk, but it is the connective tissue that turns a single compromised agent into a multi-system incident. Bounding the tool surface per task is the direct countermeasure.
What is the single most effective control for agentic AI?
A human-in-the-loop gate on destructive actions. The damaging outcomes all require a tool to act, so requiring explicit confirmation before money moves, records are deleted, or data is published removes most worst cases immediately, while you build out scoping, observability, and a kill switch.
Can guardrail models or content filters stop goal hijacking?
Only partially. Content-based filtering catches some injections but misses novel framings, and benchmarks of MCP clients show refusal firing on a small minority of poisoning attempts. Treat filters as one layer; containment through scoped identity and gated actions is what actually limits impact.
How does memory poisoning differ from a one-off injection?
A one-off injection affects the current task. Memory poisoning persists, the malicious instruction is written into a store the agent re-reads, so it can re-trigger on future, unrelated tasks. Validate what the agent persists as a trust boundary, not just what it outputs.
Where should a team start securing an agentic deployment?
Inventory what the agent can reach, scope its identity to the task, gate destructive tool calls behind a human, and log every action. Then read the MCP hardening guide and the attack-surface map to harden the servers underneath it. Start with reach and identity; they bound everything else.
Sources and further reading
- OWASP Top 10 for Agentic Applications 2026.
- Elastic Security Labs, MCP tools attack and defense.
- NSA, MCP Security Design Considerations.
- OWASP GenAI Agentic Security Initiative.
- ETDI, signed tool definitions for agent tool fabrics.
- Ransomnews: secure MCP server guide, MCP attack-surface map, prompt-injection defender’s playbook, shadow AI in the enterprise.
Keywords: agentic AI security 2026, agentic attack chain, OWASP Top 10 agentic applications, goal hijacking, tool misuse, agent identity privilege abuse, MCP agentic threats, memory poisoning, multi-agent security, autonomous agent containment, human in the loop AI.