There are basically two kinds of security advice. One is written by people who defend systems, and the other is written by people who break them. The NSA is the second kind. Its day job is getting into systems built to keep everyone out, which is why its defensive guidance reads less like a best-practices memo and more like a confession of what actually works.
Last month, the agency’s AI Security Center published its first guidance on the Model Context Protocol. MCP is the standard that wires AI agents to their tools, and it’s barely eighteen months old. NSA information sheets usually cover durable infrastructure, not young developer protocols, so when it ships a document on a new protocol, we should pay attention. Its conclusion is unusually blunt: MCP cannot enforce its own security. Whatever safety you want, you have to bring.
Here’s what’s missing, and why.
Don’t Trust What Your Agent Believes
What the NSA’s New MCP Guidance Actually Asks You to Do
The first time you watch an agent pick a tool on its own, there’s a small, specific unease. Not because it does anything wrong; it does exactly what it’s supposed to do. It reads the descriptions of the tools available to it, picks the right one, and makes the call. The unease comes later, when you notice what it read. Each tool description was written by the tool itself. In other words, the agent is hiring on résumés alone. No interview, no references, no calls to a former boss.
That, more or less, is the Model Context Protocol. MCP wires language models to the tools they call. Built by Anthropic in late 2024, MCP enables models and tools to work together without custom code. Before it, every model-and-tool pairing wanted a bespoke adapter, a problem that got worse with every new tool. MCP standardized the introduction. A tool describes itself once in a common language, and any model can call it. People described it as “USB-C for AI,” which captures the convenience but misses the nuance. A cable doesn’t have to decide whom to believe.
Imagine your agent runs a client that keeps a session open with a server. The server offers three kinds of things: read-only resources, reusable prompts, and tools. The tools are the ones with teeth, the operations that send and write and spend. And the model chooses among them at runtime, from metadata each server publishes about itself. You don’t pick which tool fires. You certainly don’t author its description. The protocol’s elegance and its exposure are inseparable.
What the NSA Found
The NSA’s May 2026 guidance reads like a diagnosis anyone who lived through the early web will recognize. A useful protocol shipped flexible and underspecified, and the security model never caught up.
Authentication is optional, so often it simply isn’t there. The protocol has no concept of roles, so “may read but never write” is a rule nothing enforces. Approval happens once, at install, which means a server you cleared in April can change what it does by June but the approval remains intact. Because the agent treats every description as instructions, a malicious server can write its own description to steer the model. And when agents chain together, one’s output becomes the next one’s input, so a single poisoned result flows downstream as a legitimate command.
None of this is hypothetical. A poisoned issue walked a GitHub server’s blanket access into a private repository and out through a public one, a finding reproduced against the official server itself. Another server advertised a harmless tool, waited out the approval, then swapped in a malicious version once the gate was behind it. The protocol’s own authors concede the root of it: MCP “cannot enforce these security principles at the protocol level.”
Whatever safety you get, you have to build or implement yourself.
OpenMatter Picks Up Where Hygiene Leaves Off
What do you build or implement? Most of the NSA’s advice is hygiene. Sandbox the tools. Scan for servers nobody remembers installing. Patch the toolchain. Prefer projects that are maintained. Do all of it first, as no checkpoint is a substitute for good plumbing.
A second cluster of recommendations is about something else entirely: what data leaves your environment, and what actions reach the world. That maps onto a checkpoint between the agent and everything it touches, and that checkpoint is what OpenMatter’s QuantumGuard was built to be. Every tool call and output crosses it. Secrets are masked before they leave, endpoints are held to an allowlist, outputs are scanned, access stays bound to the session that earned it. Each action then carries a cryptographic proof that it followed policy, generated without exposing the data the policy was guarding. It’s putting trust in a verifiable, cryptographic audit trail, evidence anyone can examine without touching what it protects.
The NSA also asks you to sign your MCP messages, and you should. But a signature proves a message wasn’t altered, not that the action it requested was ever allowed. The question of whether the action was permitted is the one a per-action proof answers, including for the server that changes its mind in June.
The category is young. The NSA says so about the tooling generally. But the question every operator eventually gets asked — what did your agent actually do — was never going to be answered by a stricter spec or a longer log. It’s answered by a proof you can check without trusting the thing that produced it. Your agent will always believe what it reads. The point is that you don’t have to.
— The OpenMatter Team
If you know someone who would benefit from reading this article, please share it:
Datavizor, our command layer for masked compute, is in beta. If you’re building AI systems where privacy and compliance aren’t optional, come take a look.
Industry Updates
OWASP Stops Speculating
A year ago, the Open Worldwide Application Security Project’s agentic-security report read like a threat-modeling exercise, naming plausible attacks and hypothetical victims. The 2026 edition, out this week, reads like an incident log. The first malicious MCP server was caught in the wild, and its patience is the unsettling part: fifteen clean releases to build a reputation, then a single line of exfiltration code once the trust was banked. A critical RCE turned up in MCP tooling used by hundreds of thousands of developers. A poisoned package on PyPI — the language-model gateway underneath several major agent frameworks — was downloaded 47,000 times in the three hours before anyone noticed. Even the safeguards got conscripted: one coding-agent flaw turned a command allowlist into the attack path, auto-approving exactly the commands the attacker needed. The pattern across all of it is the same. Attackers don’t break the agent; they compromise what the agent trusts.
Brussels Blinks, Sort Of
EU negotiators reached agreement on the Digital Omnibus, the first amendments to the AI Act since it passed, and the headline is a reprieve: high-risk obligations move from this August to December 2027, with AI embedded in regulated products getting until 2028. The stated reason is candid enough — the harmonized standards meant to make compliance possible aren’t finished, so enforcing against them would have punished companies for the regulator’s backlog. But read the fine print before recalibrating anything. The delay only binds once it’s published in the Official Journal, which hasn’t happened yet, so August 2 remains the law until it does. And the hard part of compliance was never the documentation template. It’s knowing which of your AI systems fall in scope, what they actually did, and being able to show a regulator. This work doesn’t get easier with a longer runway; it’s only easier to postpone.
OpenMatter is building the verifiable trust layer that enables AI agents to securely collaborate on sensitive data sets. If you’re in a regulated industry and need a better way to prove that your data is secure, contact Chris to learn how masked compute can help.