Agentic AI is moving very fast. MCP servers and tools are becoming the connecting layer of that system - connecting models to filesystems, databases, APIs, and third-party services. But most production deployments ship without the security controls that stand between sensitive data and an attacker.
This session is about what that gap actually looks like, and how to close it.
The first half is offence. I'll walk through the real attack classes targeting MCP deployments today - tool poisoning, rug pull attacks, cross-server shadowing, and prompt injection via tool results - with demos showing how each is executed.
The second half is defence. I'll introduce a four-layer security stack and explain exactly what each layer stops:
Layer 1: Sandboxing and Process Isolation - preventing a compromised tool from becoming a compromised host
Layer 2: Authorization Boundaries and Least Privilege - fixing the confused deputy problem and eliminating static credentials
Layer 3: Tool Integrity Verification - pinning tool descriptions and detecting rug pulls before they reach production
Layer 4: Runtime Monitoring and Anomaly Detection - catching attacks that look like normal protocol behavior
The session closes with multi-tenant MCP deployments: how context over-sharing happens across tenants and the isolation patterns that prevent it.
As a reference for the level of technical depth attendees can expect, I have included an article I wrote on MCP security that explores many of the attack classes and defensive patterns which are going to be discussed in this session.
