AI Governance Institute
← News
Standards2026-08-16

MCP Project Publishes Sandboxing Baseline for Enterprise Agent Deployments

What happened

The Model Context Protocol project released Security Best Practices - Model Context Protocol on July 28, 2026, formalizing a set of security controls for MCP server deployments. The guidance centers on two requirements: spawned processes should run inside sandboxes or containers, and file system access for MCP servers should be tightly restricted to only what is necessary for the task at hand. MCP is the open protocol that enables AI agents to connect with external tools, data sources, and system resources, and it has seen rapid adoption across enterprise agentic deployments. The publication follows a series of documented incidents, including a prompt injection attack on Azure DevOps MCP, a compromised bridge in Ruflo that enabled command execution and API key theft, and guidance from the DoD flagging MCP agent prompt injection as an enterprise toolchain risk. The MCP project's own security baseline now gives compliance teams a primary-source document to reference when assessing whether their agent deployments meet reasonable care standards.

Why it matters

  • ·The MCP project's published guidance now functions as the protocol developer's own floor for reasonable care, meaning auditors, regulators, and insurers can cite it when evaluating whether an enterprise's agent deployment controls were adequate at the time of an incident.
  • ·Organizations that deployed MCP servers without sandboxing or file system restrictions have a documented gap that needs remediation before the next audit cycle. Failure to address it could affect findings under frameworks such as the EU Cyber Resilience Act, which requires products with digital elements to meet baseline security requirements.
  • ·The guidance directly implicates agent permission boundary controls and least-privilege principles. Where agents can reach local files, shells, or credential stores, unrestricted MCP server access creates a blast-radius risk that incident response programs must account for, as demonstrated by recent cases of AI agents being weaponized to suppress audit logs.

Governance controls affected

AGT-008Agent Environment IsolationAGT-001Agent Permission BoundariesAGT-018Agent Data Modification Blast-Radius ContainmentAGT-002Agent Prompt Injection DefenseSEC-002AI System Access Controls

What to do now

  • ☐Inventory all MCP servers currently in production or pilot and document whether each runs spawned processes inside a sandbox or container.
  • ☐Audit file system access permissions for every MCP server and restrict access to only the directories and files required for the specific agent task.
  • ☐Update your agent deployment intake process to require sandboxing and file system restriction documentation as a pre-production approval gate for any new MCP server.
  • ☐Review vendor and open-source MCP server configurations against the published MCP security best practices and flag deviations for remediation tracking.
  • ☐Incorporate the MCP security best practices document as a reference standard in your AI tool and plugin supply chain risk assessment process.

What to watch next

Compliance teams should monitor whether major MCP host platforms and tool marketplaces update their own security requirements to align with the new guidance, since platform-level enforcement could accelerate the timeline for enterprise remediation. Regulatory bodies working on agentic AI controls, including those developing rules under the Model AI Governance Framework for Agentic AI, Version 1.5 and the Financial Stability Board Recommendations on Agentic AI Controls in Financial Services, may cite protocol-level guidance as evidence of industry consensus. The volume of MCP-specific incidents documented by security researchers and government bodies suggests enforcement attention on this control surface will increase before it decreases.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-09-02

Cyble's 2026 Report Codifies Untrusted-Input and Least-Privilege as Baseline Agent Controls

Cyble's AI Threat Landscape Report 2026 catalogues the attack surfaces surrounding agentic AI deployments, including prompt injection, RAG poisoning, vector store manipulation, and API credential theft. The report recommends that enterprises treat all content ingested by AI systems as untrusted, enforce least-privilege boundaries for every agent, and conduct adversarial red teaming as a standard operational control. Its findings represent a threat-intelligence codification of risks that regulators and auditors are increasingly treating as the baseline for reasonable AI security.

Research2026-09-01

CSA/OWASP Agentic AI Maturity Model Exposes Systemic Prompt Injection Risk

Cloud Security Alliance Labs has published a CISO-focused maturity guide analyzing the OWASP Agentic AI governance model. The guide identifies prompt injection as a central and systemic failure mode across agentic AI deployments, arising because current models cannot reliably separate system instructions, user input, and retrieved content. It calls for stronger input sanitization, enforced privilege boundaries, and rigorous testing of retrieval-to-execution pathways.

Research2026-08-28

60-80% Attack Success Rate Exposes Claude Code Auto Mode as a Security Gap

Security researcher Johann Rehberger demonstrated a multi-step prompt injection attack against Anthropic's Claude Code running in Auto Mode, achieving code execution success rates between 60 and 80 percent. The attack begins with a routine website summarization request and can escalate to spawning an autonomous child agent with its own tool access. Anthropic responded by characterizing Auto Mode as a convenience feature backed by a best-effort classifier, not a security control, placing the containment burden squarely on enterprise deployers.