Pieter Danhieux is the Co-Founder and Chairman/CEO of Secure Code Warrior.
The cybersecurity industry, which has been advocating for “security by design” principles for more than a decade, stands in wide-eyed amazement at the risks posed by artificial intelligence (AI). As organizations rush to embrace AI enablement, a CISO’s most pressing priority is to avoid becoming a roadblock. However, without effective AI usage and governance, observability and traceability, organizations may be blindsided by their AI risk.
The National Security Agency (NSA) has recognized that AI deployments need to give greater consideration to security-by-design principles in its May 2026 report, “Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation.”
2026 has become the year of agentic AI: AI agents with the ability to call tools to complete their goals. Claude Code is now writing and committing code into production-bound environments.
Model Context Protocol (MCP) has emerged as a communication standard to coordinate these agents (essentially APIs for AI agents). However, as the NSA notes, “MCP’s rapid proliferation has outpaced the development of its security model.”
MCP-specific risks include dynamic tool-calling, implicit trust relationships and context sharing, as well as more familiar failures, such as unauthorized access, insecure misconfigurations and poor or missing audit logs.
CISOs understand they cannot become a roadblock to AI maturity, but it is essential that they provide guardrails.
An Inverted Architecture Introduces Risk
MCP and API are both communication standards, but MCP inverts the model. A traditional API client requests data from a server; an MCP server queries and executes actions on the client’s behalf. This inversion creates “new and largely not well-traced attack paths.”
The deeper shift goes beyond just the protocol to the AI itself. Agentic AI is a double-edged sword because its goal-seeking behavior and dynamic tool calling are both its value proposition and a source of risk.
In July 2026, an OpenAI agent compromised HuggingFace’s infrastructure during a benchmarking evaluation. Its models, focused on solving the evaluation, chained real vulnerabilities to break out of their sandbox.
Layered on top of that autonomy is a separate problem: AI outcomes are probabilistic, not deterministic. LLMs generate outputs by sampling from likely responses, so the same prompt can yield multiple results.
AI agents still hallucinate, producing fluent, confident and wrong responses. The reliability of responses degrades as context grows. The NSA warns that long-lived or overlapping context windows can “leak, blend, or misalign across tasks.”
The result is that autonomous agents are taking real-world actions, driven by an engine that is occasionally incorrect, inside architectures that accept one agent’s output as valid without verification. The risk is implicit trust. When an unverified, possibly hallucinated output becomes the trusted input to the next tool call, errors propagate across the system.
Developers may be deploying MCP without fully understanding these implications. While fostering a culture of cybersecurity to educate developers about these risks, the primary control must be to find and fix them.
A Framework For A New Frontier
Visibility into what agentic AI is doing, where it’s doing it, and for whom can no longer be treated as a nice to have.
Organizations should now examine whether their existing security controls are keeping pace with agentic AI. There’s no time to wait for another set of regulations to force the issue. An entirely new set of protected deployment best practices, heightened risk awareness and governance approaches must take hold, framed upon the following components:
Visibility/Awareness
Through relentless real-time monitoring, organizations gain deep observability and traceability into AI coding tools, LLMs and MCP, as well as up-to-date information on which agentic AI tools are in use, who is using them, and how they are being employed.
Missing audit logs have emerged as a most critical MCP security concern. Without traceable records, incident response faces significant difficulties. Yet, by effectively leveraging logs and additional visibility/monitoring resources, teams can map the full progression of AI adoption stages in software development, from minimal AI assistance to fully autonomous agentic orchestration. Not all AI deployments carry the same risk.
Training
Similarly, not all developers are at the same skill level or use AI in the same way. The most impactful training sessions meet them where they are. Organizational leaders must ask key questions: “Are our teams able to accurately spot and identify AI-created code? Do they have the skills to effectively remediate AI-generated problems?”
Then, they need to structure job-relevant, hands-on lessons based on the skill gaps of different developer team members. As a result, participants receive the most relevant training and build secure coding proficiency more quickly.
Overarching Governance
Leaders must establish policies and procedures that match the velocity of AI agents today, so that developer team members’ security standards align with the organization’s, and only approved AI tooling and practices are used. Ultimately, good governance is about ensuring these team members deploy AI correctly from the start, producing secure code, avoiding recurring vulnerabilities and using AI efficiently throughout the SDLC to keep costs under control without sacrificing protection.
The Bottom Line
As MCP and agentic AI adoption accelerate, the NSA’s guidance highlights the need to rethink how organizations apply secure-by-design principles to autonomous systems.
Through enhanced visibility, situational awareness, targeted training and overarching governance, organizational leaders gain a clear and comprehensive understanding of the total AI adoption picture—and enforce the guardrails to defend it.
In doing so, CISOs can maintain the sanctity of secure-by-design principles, while their organizations adopt AI enablement programs.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?