Registry
Seven failed access controls across five registry incidents
Each row is a control that was in place, or should have been, and did not hold. The incident record explains who was responsible and what changed afterward.
| Incident | Date | Control | Responsible | What failed |
|---|---|---|---|---|
| EchoLeak Turns Microsoft 365 Copilot Into a Data Leak | Jan 2025 | Content security allowlist | Microsoft | An allowed Teams preview service fetched the attacker's address |
| Replit Agent Deletes the SaaStr Database | Jul 2025 | Environment separation | Replit | Apps used one database for development and live data |
| Stolen Drift Tokens Drain Salesforce Data | Aug 2025 | Connected-app scope | Customers | Drift's tokens allowed broad bulk queries |
| Stolen Drift Tokens Drain Salesforce Data | Aug 2025 | Secrets in records | Customers | Credentials stored in CRM records let attackers reach further systems |
| Nx Malware Turns AI Coding Tools Against Their Users | Aug 2025 | Permission prompts in AI tools | Users and tool makers | Command-line flags skipped every approval prompt |
| Cursor Agent Deletes the PocketOS Database | Apr 2026 | Least-privilege token | PocketOS and Railway | A full-permission token let a staging task delete production |
| Cursor Agent Deletes the PocketOS Database | Apr 2026 | Delayed delete | Railway | An old endpoint deleted at once with no delay |
Implementations
Agent access is moving from stored keys to short-lived, centrally managed tokens
MCP's Enterprise-Managed Authorization lets an organization approve MCP servers centrally with single sign-on. Microsoft's Agent 365 attaches access policy to each agent's directory identity. GitHub's coding agent runs behind a default outbound firewall, though GitHub says MCP servers are outside it. China's TC260 draft guide covers agents from installation to removal, including unsanctioned "shadow" agents.
| Implementation | Vendor or body | Country | What it enforces | Status |
|---|---|---|---|---|
| Agent 365 with Entra Agent ID | Microsoft | United States | Per-agent identity and access policy across the agent registry | GA May 1, 2026 |
| Copilot coding agent firewall | GitHub | United States | Default-on outbound allowlist for the agent shell; MCP servers not covered | Current |
| MCP Enterprise-Managed Authorization | MCP project and Okta | United States | Central authorization of MCP servers with single sign-on | Stable Jun 18, 2026 |
| MCP specification 2026-07-28 | MCP project (Agentic AI Foundation) | International | Deprecates dynamic client registration; issuer validation; credentials bound to issuer | Released Jul 28, 2026 |
| MCP-scan and Invariant Guardrails | Invariant Labs | Switzerland | Audits agent-to-MCP traffic; per-session repository limits | May 2025 |
| Practice guide for OpenClaw-class agents | TC260 | China | Install-to-removal lifecycle controls; governance of shadow agents | Draft Apr 2026 |
Row color shows the agent class served: orange physical, teal personal and ambient, blue software.
Recent events
- On May 26, 2025 Invariant Labs showed a public GitHub issue steering an agent into leaking private repository data through the GitHub MCP server.
- A flaw in Asana's MCP server exposed data across about 1,000 customer organizations for over a month before it was found on June 4, 2025.
- JFrog found remote code execution in mcp-remote versions 0.0.5 to 0.1.15; version 0.1.16 fixed it on June 17, 2025.
- A Cursor agent used a broad Railway token to delete the PocketOS production database in April 2026.
Exposure
Integrations and permissions rates very significant or critical for six of 17 agent types
The access and authorization discipline covers the integrations and permissions dimension of the agent attack surface ratings. These agent types depend on it most.
| Agent type | Dimension | Rating | Why |
|---|---|---|---|
| Workflow agents | Integrations and permissions | Critical | The defining dimension |
| Enterprise agents | Integrations and permissions | Critical | Connectors and MCP servers set what an agent can reach |
| Phones and tablets | Integrations and permissions | Very significant | App integration, third-party AI routing (such as Apple Intelligence to ChatGPT), enterprise integrations, cloud sync |
| Smart home assistants | Integrations and permissions | Very significant | Cross-vendor integration through Matter and major platforms |
| Coding and research agents | Integrations and permissions | Very significant | The defining dimension for this category |
| Commerce agents | Integrations and permissions | Very significant | The defining dimension |
Rules
Open specifications and OWASP set agent access practice; China's rules add approval duties
| Rule | Jurisdiction | What it requires | Status |
|---|---|---|---|
| MCP specification 2026-07-28 | Open standard | Client ID metadata documents replace dynamic registration; issuer validation; credentials bound to issuer | Released Jul 28, 2026 |
| OWASP Top 10 for Agentic Applications | International | Identity and privilege abuse, tool misuse and insecure agent-to-agent traffic | Dec 2025 |
| CoSAI Agentic Identity and Access Management | Industry (OASIS) | Agents as non-human identities with full lifecycle management | Mar 2026 |
| China agent Implementation Opinions | China | Defined decision authority; human approval for significant actions | Effective Jul 15, 2026 |
| CNCERT OpenClaw security guideline | China | No admin privileges; isolated hosts | Mar 2026 |
Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.
Limits
Least privilege is hard to hold when agents need broad access to be useful
Permissions also tend to grow over time, and access control also cannot tell a legitimate instruction from an injected one once the agent is allowed to act.
Record
Page Record
- Datasets
- ai_control_implementations.csv (6 rows for this page); ai_incident_controls.csv (7 linked); ai_attack_surface.csv
- Key sources
- GitHub
Invariant Labs
MCP project (Agentic AI Foundation)
MCP project and Okta
Microsoft
TC260 - Source notes
- MCP-scan and Invariant Guardrails: vendor source; Practice guide for OpenClaw-class agents: secondary source
- Last verified
- October 2026