AI Agent and MCP Security Audits: What Teams Should Validate

Which tools the agent can invoke, under what conditions, and whether each tool's blast radius matches the agent's intended scope.

What customer, tenant, or internal data the agent (and its tools) can read or write — and whether those reads respect existing application boundaries.

Whether the agent operates with a single privileged identity or correctly impersonates the calling user, and how that decision shows up in downstream APIs.

What state-changing actions the agent can take autonomously, and whether sensitive actions require human confirmation or stronger authorization.

How the agent behaves under prompt injection in retrieved content, tool output, or user input — and what the worst-case path actually reaches.

Whether long-running or multi-step workflows preserve authorization checks at every step, not just at the entry point.

Whether the underlying APIs the agent calls enforce the same authorization the human-facing UI does, including object-level and field-level controls.

Whether RAG indexes, tool responses, or logs leak data across tenants, customers, or trust boundaries.

Whether the agent can reach admin-style operations — account changes, exports, escalations — and what proves that authorization holds.

The most common AI-agent vulnerability: a tool or endpoint authenticates the caller but never confirms the caller is allowed to touch the requested record.

Agent behavior can drift as prompts, models, tools, or data sources change. Without re-validation, prior assurances no longer hold.