Beyond Identity: Governing the Agentic Enterprise | Akamai
Akamai's SOTI report warns that autonomous AI agents using Model Context Protocol expand the enterprise attack surface via prompt injection, browser extension risks, and sensitive data exposure in chatbot conversations. AI agents using Model Context Protocol (MCP) blur data and code, enabling prompt injection and cross-server attacks that can hijack LLM logic. Over 40% of enterprise users have installed AI browser extensions, which are 60% more likely to have known vulnerabilities than other tools, with 25% altering permissions within 12 months. More than 6% of enterprise AI chatbot conversations contain sensitive data.
Detection / Hunteropenrouter
Immediate Actions
- Inventory all MCP services and their connected tools and permissions
- Audit enterprise AI browser extensions for known vulnerabilities
- Review AI chatbot data handling for sensitive information exposure
Key Takeaways
- MCP enables AI agents to call APIs but enables prompt injection and cross-server attacks
- 40%+ of enterprise users installed AI browser extensions
- AI browser extensions 60% more likely to have known vulnerabilities
- 25% of installed AI extensions changed permissions within 12 months
- 6%+ of enterprise AI chatbot conversations contain sensitive data
Attack Chain
- Initial Access: Malicious MCP server or prompt injection compromises AI agent logic
- Execution: Compromised agent calls external APIs and tools via MCP connections
- Discovery: AI browser extensions with altered permissions broaden browser attack surface
- Collection: Sensitive data exposed through AI chatbot conversations on enterprise devices
- Impact: Unauthorized actions triggered across enterprise workflows by hijacked agent
Affected Systems
- Enterprise AI agents using Model Context Protocol
- Enterprise browser extensions (AI-powered)
- Enterprise AI chatbot platforms
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Article focuses on API, MCP, and browser extension risks, not endpoint telemetry. |
| Network Visibility | Medium | API authorization and MCP service traffic monitoring are recommended. |
| Detection Difficulty | Hard | Behavioral governance of autonomous agents requires new visibility and context analysis. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| MCP services making unexpected API calls or accessing data beyond declared permissions indicate compromise (T1021) | MCP service audit logs and API gateway traffic | Execution | Medium — legitimate agents may have broad permissions |
| Browser extensions changing permissions post-install and accessing AI chatbot content indicate data collection (T1179) | Browser extension management logs | Collection | Medium — legitimate updates may change permissions |
Required Log Sources
- API gateway logs
- MCP service audit logs
- Browser extension telemetry
- AI chatbot conversation logs
Key Behavioral Indicators
- MCP service permission changes after initial configuration
- AI agents calling APIs outside declared scope
- Browser extensions modifying permissions post-install
- Sensitive data in AI chatbot conversations
- Anomalous agent-to-agent communication patterns
Control Gaps
- Static IAM policies cannot govern agent runtime behavior
- Browser extension monitoring lacking for AI tools
- API authorization gaps for machine-to-machine AI calls
- No real-time MCP service visibility
False Positive Assessment
Medium — legitimate AI agents and extensions may exhibit similar behaviors; context and baseline analysis needed.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Apply real-time API protection at the edge to monitor agent-driven calls
- Implement Zero Trust controls for machine identities and agent permissions
- Maintain an AI software bill of materials for all agent-connected tools
User Protection
- Deploy browser controls restricting AI extension installation
- Set clear employee AI usage policies to reduce data exposure
- Block AI extensions with known vulnerabilities on managed endpoints
Security Awareness
- Train employees on risks of AI chatbot data exposure
- Update security training to cover agentic AI risks
MITRE ATT&CK Mapping
Lateral Movement
Plain-Language Summary
Akamai's report finds that autonomous AI agents in workplaces create new security risks by connecting to systems through a protocol called MCP, which can be exploited. Many employees have installed AI browser tools that frequently change permissions and are more likely to have security flaws. Sensitive information appears in over 6% of workplace AI chat conversations. Organizations should monitor what AI agents can access and do in real time.