Why MCP security is about permissions overhaul
Anthropic’s Model Context Protocol (MCP) went into production in late 2024. It spread rapidly after that. Since then, thousands of The post Why MCP security is about permissions overhaul appeared first on The New Stack .
Model Context Protocol (MCP) security is about addressing permission issues. After MCP went into production in late 2024, it rapidly gained adoption by major tech companies like Microsoft, Google, and OpenAI. The Linux Foundation now maintains the protocol. MCP acts as a bridge between AI agents and the tools and data they interact with.
In 2026, it became clear that the real issue wasn't the MCP infrastructure itself, but the permissions below it that were causing problems. This shift in perspective led to a realization that the permissions weren't well-thought-out initially. The SANS 2026 Identity Threats Survey revealed that 76% of businesses had seen an increase in non-human identities, and 74% use AI systems that rely on standing credentials to operate independently.
However, only 40% of businesses use protection measures like approval processes, sandboxing, or logging.
The root cause of many security issues stems from overly broad access given to MCP servers and agents. In May 2025, a GitHub MCP server was targeted using prompt injection, which allowed an attacker to access private repository data due to an excessively broad personal access token. Another instance saw an Asana MCP integration causing cross-tenant access because the permission layer failed to enforce isolation boundaries.
To enhance MCP security, compartmentalizing access is the key solution. GitHub suggests implementing unique secrets for each specific task, limiting requests to the acting user, and basing authorization on actions rather than assuming it after user authentication. Instead of using fixed, permanent tokens, generating dynamic, temporary credentials on the fly is recommended.
When integrating MCP, consider what the credential can access now, not just what it was intended for. Review authorization settings at various levels (per-site, per-repository, per-Workspace) rather than opting for organizational access by default. Ensure that the AI agent creates entirely new credentials that bypass existing permissions, rather than inheriting the person's existing credentials, which could lead to excessive access.
Lastly, establish a review process for actions taken by the AI agent, similar to the human access control review process, to maintain accountability. Recognize that the current identity of agents is often just a human's OAuth token wrapped in a trenchcoat, rather than having their own identity. As agents become more persistent, they need their own identity with strict permissions that tighten over time, rather than inheriting broad access from the originating human.
Written by urgent.news from The New Stack's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
