# Even the NSA Is Warning About the Protocol Connecting AI Agents to Your Stack

_In May 2026 the NSA's AI Security Center published security guidance on the Model Context Protocol. It flags missing authentication, capability changes that need no approval and implicit trust between agents._

By Johannes Keienburg, CEO & Founder  
Published: 2026-06-16  
Source: https://www.cakewalk.security/blog/nsa-mcp-security-guidance

---

## MCP's Design Creates the Risk

In May 2026, the National Security Agency's Artificial Intelligence Security Center published security guidance dedicated to the [Model Context Protocol](/glossary/model-context-protocol) (MCP), the open standard that connects AI agents to the apps and data they act on.

> MCP's rapid proliferation has outpaced the development of its security model.

_NSA Artificial Intelligence Security Center_

Although MCP now runs in production across finance, legal and software development, the NSA locates the risk in the protocol's design rather than in any single bug. MCP inverts the usual client-server pattern: its servers can query and sometimes act for the connected client. That inversion, the NSA says, "creates new and largely not well-traced attack paths." The agency found that many implementations skip authentication entirely and that the protocol has no built-in way to exchange [Role-Based Access Control](/glossary/rbac) (RBAC) permissions. Agents trust each other's output without verification. Long-lived context can blend across separate tasks.

## Approved Access Can Escalate Without Review

The NSA states its most serious concern plainly:

> A previously benign and approved AI service could later access sensitive resources on demand, without triggering any review.

_NSA Artificial Intelligence Security Center_

The NSA points to real cases. A GitHub MCP integration granted blanket read and write access across private and public repositories. A separate flaw (tracked as CVE-2025-49596) allowed remote code execution in software used to test [MCP servers](/glossary/mcp-server). The NSA concludes these are not problems to patch at the endpoint level. Securing MCP means "treating the agentic environment as a continuum."

## The NSA's Answer Is Runtime-Scoped Access

The NSA's own recommendations point the same way. It tells organizations to draw trust boundaries between agents, plugins, models and users, to put MCP agent processes under [least privilege](/glossary/least-privilege) and to deny any access path they do not need, explicitly and at runtime. Dynamic tool discovery, it adds, should require authorization checks rather than implicit trust.

MCP's security never caught up with its adoption. Because the protocol provides little protection of its own, the safeguards fall to whoever runs it. Several of the NSA's recommendations converge on the same idea: keep every agent's access tightly scoped and re-checked as it changes.

> The NSA is describing the gap we design against. An agent's access does not stay still: permissions widen, capabilities change and approvals get skipped, none of which the protocol can catch. So instead of trusting access granted once at onboarding, we hold every agent to the least it needs and re-check that access at runtime, on every action it takes.

_Comment from Gil Röder, CPO & Co-Founder_

Source: NSA Artificial Intelligence Security Center, "[Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation](https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSI_MCP_SECURITY.pdf)", Cybersecurity Information Sheet, May 2026.