Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Prompt injection in a standard LLM interaction produces bad output. The model says something it shouldn’t. The damage stays contained to text. Prompt injection in an MCP environment is a different problem. Agents built on the Model Context Protocol don’t just generate responses. They call tools. They write files, query databases, send emails, execute code, invoke APIs.

API discovery has become a foundational capability for modern enterprises as API ecosystems expand across cloud-native applications, microservices, SaaS integrations, partner APIs, and AI-powered workflows. By 2027, 78% of applications are expected to use APIs, and with that growth comes an urgent need for visibility that goes far beyond simply listing endpoints.

An agent reads a file, approves its own next action, and the change survives the session. That one design choice, repeated across nearly every AI coding tool built in the last eighteen months, is the reason this keeps happening.

Healthcare has spent years strengthening its infrastructure against ransomware, patching vulnerabilities, deploying endpoint detection, and implementing zero-trust architectures. Yet, attackers continue to find new ways to compromise healthcare organizations.

Healthcare has moved well past pilot projects. AI agents now triage support tickets, draft clinical documentation, manage patient engagement, and coordinate care across systems that were never designed to talk to autonomous software. Autonomous systems can now analyze data, make decisions, trigger actions, and coordinate across clinical systems with minimal human oversight.

Ask any security leader how many APIs their organization runs, and you’ll usually get a confident number. Ask them how many of those APIs are actually being called by an AI agent, a copilot, or an automated workflow right now, and the confidence tends to disappear. That gap is the problem. APIs have always outpaced the inventories built to track them; new services ship every sprint, integrations get added without a ticket, and old endpoints get deprecated without ever being switched off.

Ask any security leader how many APIs their organization runs, and you’ll usually get a confident number. Ask them how many AI agents are operating in their environment right now, what those agents are deciding to do, and which APIs they’re calling to do it, and the confidence tends to disappear.

Model Context Protocol (MCP) is what turns an AI assistant into an AI agent. It’s the standardized bridge that lets models call real tools – read files, query databases, send messages, pull emails. That capability is the whole point. It’s also what makes MCP environments a target. Most deployments were scoped for what the agent needed to do. Not for what happens when that access is turned against the organization.

Nine seconds. One API call. A car rental software company’s production data was gone. That’s the headline from the PocketOS incident, and it’s the reason this story spread across engineering and security circles the way it did in late April. Two months later, the incident is no longer breaking news. But it hasn’t aged out of relevance; it has aged into a pattern.

Every enterprise deploying AI agents is building on a foundation of third-party MCP servers they don’t control, can’t verify, and barely track. The security conversation keeps focusing on the model – prompt injection, jailbreaks, hallucinations. That’s the wrong place to look. We’ve covered why that framing falls short elsewhere too – see System Prompts Are Not Security Boundaries. Business Logic Graphs Are.

Every major tournament cycle, ticketing platforms brace for a traffic spike. Most security teams plan for volume. The attack data tells a different story: the traffic that does the most damage isn’t the loudest traffic. It’s the traffic that looks like a real fan, on a real device, doing something a real fan would plausibly do, just millions of times, in a pattern no single fan ever would.

OWASP, the Open Worldwide Application Security Project, has published Top 10 lists for over two decades to help security teams prioritize the risks that matter most. The original OWASP Top 10 for web applications became the industry’s default checklist for application security. When large language models moved into production, OWASP followed with the Top 10 for LLM Applications, addressing risks like prompt injection and sensitive information disclosure in single-turn model responses.

Three weeks ago, it was ServiceNow: an endpoint that never asked who was calling, exposing customer data to anyone who asked. This time it’s Oracle PeopleSoft, exploited at scale by the threat actor ShinyHunters. Two platforms, two different vendors, the same root failure: an endpoint that skipped the one question it existed to ask. That’s not a coincidence you write off as bad luck at two companies.