Moving past the chatbox: The hidden risks of agentic AI and MCP in enterprise infrastructure

In Singapore, Hong Kong, and other parts of the Asia Pacific region, companies have begun rolling out Generative AI beyond the trial stage. While initial implementations used simple internal chatbots, experts now recognize that the true value lies in autonomous AI agents. These agents can access enterprise context and perform live API actions across legacy systems. However, this rapid adoption of agentic AI has exposed hidden risks that traditional security measures struggle to address.

The Model Context Protocol (MCP) enables large language models to connect securely to local data sources, development tools, and enterprise environments. Yet, this architecture creates an unmanageable perimeter risk. Unlike legacy security solutions, MCP doesn't operate at the network or packet layer, meaning traditional firewalls and data loss prevention systems cannot monitor the semantic layer of LLM prompts and autonomous workflows.

Three key risks stand in the way of safe enterprise AI deployment:

1. Autonomy risk: Once granted execution rights via MCP, autonomous agents can become vulnerable to Prompt Injection attacks. Malicious inputs can manipulate the agent's logic, leading to unauthorized API execution or lateral movement within the network. Traditional post-incident auditing is too slow to mitigate such damage.

2. Privacy paradox: To make AI agents useful, they need access to deep organizational data. However, this requirement creates a trade-off between intelligence and privacy. Security models force organizations to either limit AI capabilities by withholding data or risk compromising privacy by passing raw tokens across corporate boundaries.

3. FinOps nightmare: Autonomous agents operating in the background can easily fall into execution deadlocks. A single looped agent misinterpreting a complex database schema can cause thousands of dollars in token expenditure within hours, while also breaking compliance audit trails.

To harness the full potential of agentic AI without exposing critical core assets, APAC enterprises must shift from reactive monitoring to proactive, runtime governance. A central AI Access Gateway should be implemented, deploying a client-controlled data plane at the boundary level. This gateway must perform real-time, zero-trust token scrubbing before any agentic prompt or MCP resource payload reaches an external LLM provider.

It should de-identify PII, remove sensitive API keys, and mask core proprietary source code locally within the organization's domain.

Once the model returns its response, the gateway dynamically re-identifies the tokens, allowing seamless execution of the local workflow. Additionally, the orchestration layer should feature circuit breakers to halt deadlocked agents and implement intelligent model routing. By offloading long-context, low-risk MCP tasks to highly optimized local open-source models, enterprises can manage FinOps overhead more effectively.

As AI becomes the digital foundation of modern commerce, the real question is no longer about which model is the smartest. The crucial concern is who controls the data plane that safeguards these models from hidden risks. By addressing these challenges, organizations can unlock the true power of agentic AI while maintaining robust security.