By Model Context Protocol is spreading through enterprise AI stacks faster than security teams can inventory it. When a third-party marketing tool silently runs MCP, it can become a threat vector inside a business unit that never flagged it to security. Tool poisoning, context spoofing, prompt state manipulation, scope creep, and leaked session tokens are live risks, not theoretical ones, and most organizations have no map of where their exposure sits.
In this interview on TFiR, Steve Winterfeld, Advisory CISO at Akamai, breaks down the MCP threat categories his team tracks and explains what a rigorous internal AI inventory requires before those gaps are exploited.
Guest: Steve Winterfeld, Advisory CISO at Akamai
Show: TFiR
Here is what every security architect and enterprise AI team needs to know.
Technical Deep Dive
Q: What is MCP exposure and why does it create a new security risk for enterprise AI?
Steve Winterfeld, Advisory CISO at Akamai, explains that Model Context Protocol functions as a wrapper that makes API interaction with AI models more efficient, but that same efficiency layer introduces attack surface that most teams have not mapped. The risk is not only in external-facing AI systems: internal tools, development pipelines, and third-party software purchased by individual business units can all run MCP without central security visibility. If a marketing tool bought outside of IT uses MCP to interact with an AI model, it can introduce a threat vector inside that capability without the security team knowing it exists.
“Understanding where these wrappers around more efficient API interaction with AI models is important.”
Steve Winterfeld, Advisory CISO, Akamai
Q: What are the primary MCP vulnerability categories security teams should track?
Winterfeld groups MCP risks into two buckets: vulnerabilities and configuration failures. The vulnerability category includes tool poisoning, context spoofing, and prompt state manipulation. He notes these are catalogued in the OWASP Top 10 for MCPs, currently in beta, which he recommends as a baseline resource. These attacks do not require an adversary to gain direct system access; they work by introducing malicious data or manipulating the context the model operates in.
“Tool poisoning, context spoofing, prompt state manipulation: these are all coming out of the classic OWASP MCP Top 10.”
Steve Winterfeld, Advisory CISO, Akamai
Q: What MCP configuration mistakes most commonly create enterprise risk?
On the configuration side, Winterfeld flags scope creep, unrestricted agent access to sensitive tools, session token leakage, and missing human-in-the-loop controls for status changes as the most common failures. These are not vulnerability-class issues in the traditional sense; they are design and deployment decisions that expand the blast radius when something goes wrong. An agent granted broad access to sensitive systems without approval gates is a risk multiplier, not just a misconfiguration.
“Are you allowing agents unrestricted access to sensitive tools? Do you not have a human in the loop for status change?”
Steve Winterfeld, Advisory CISO, Akamai
Q: How should enterprises build an internal AI inventory that covers MCP usage?
Winterfeld describes a three-layer inventory challenge: where employees are using AI directly, where AI faces external customers, and the middle ground of internal AI software and build materials. He stresses that the middle layer, covering internal development and third-party tools procured by individual teams, is the one most organizations have not mapped. The inventory needs to capture not only where AI runs but whether those deployments use MCP and what decisions or actions those MCP-connected agents can take.
“That middle ground of where is my AI software building materials, where is my inventory, how do I know where I’m using AI internally and if it is using MCP?”
Steve Winterfeld, Advisory CISO, Akamai
Resources & Documentation
- Akamai, enterprise security research and advisory including AI threat tracking
- OWASP Top 10 for MCPs (beta), community baseline for Model Context Protocol security risks
***
👇 Click to Read Full Raw Transcript
Swapnil Bhartiya: Today we kind of live in a world where MCP or model context protocol is kind of becoming a critical part of the whole enterprise AI workflow, because that exposes a lot of tools, a lot of services through them very easily. But they also can become once again exposure for security. Can you talk about what exactly is MCP exposure and how does it connect to the AI threats that you have tracked in previous reports?
Steve Winterfeld: Yeah, and I mentioned this briefly up top and it’s one of the right ones to drill into because ultimately here, you know, you’re going to get different capabilities that you’re going to bring in. And so one of the things I try to inventory is, you know, where my employees are using AI, where I have AI externally facing customers, but that middle ground of where is my AI software, building materials, where is my inventory, how do I know where I’m using AI internally and where I’m using AI internally, is it using MCP? And so this internal inventory, both where I’m developing it, what tools I bought that have it, and then if I bought a tool in marketing that’s using it, is it going to make a decision within marketing or is it going to make a threat vector within that marketing capability that I need to be aware of? And so, you know, understanding where these wrappers around, you know, more efficient API interaction with AI models is important. And I bucket into two kind of things. One is what are the vulnerabilities, tool poisoning. And again, this isn’t something they need to get access, it’s something they introduce data to. Context spoofing, prompt state manipulation. And again, these are all coming out of a classic OWASP MCP. So if you want to go understand that if you go up to OWASP top 10 for MCPs, it’s in beta right now, but it’s still a great resource. The other side of this is how you’re configuring things. You know, are you allowing scope creep? Are you allowing agents unri access to sensitive tools? Or are you leaking session tokens? Do you not have a human in the loop for status change? So these are the kind of things that, that you need to really think through with MCP.
