The AI agent attack surface

Unscoped Outbound Connections

Most AI agents can connect to any endpoint on the internet. This means a compromised agent, a prompt injection attack, or a misconfigured workflow can exfiltrate data to any destination, connect to command-and-control infrastructure, or access services far beyond what the agent needs for its function.

MCP Server Trust

Agents connect to MCP servers referenced in their configuration. If an attacker can influence agent configuration, or if a developer adds an unvetted MCP server, the agent will connect to it with whatever credentials it has. Without connection governance, there is no mechanism to detect or prevent this.

Credential Exposure

AI agents often operate with service account credentials, API keys, and OAuth tokens. When an agent connects to an unauthorized endpoint, those credentials travel with the connection. Scoping agent connections reduces the blast radius of credential compromise.

How to Reduce the Agent Attack Surface

1. Inventory all agent connections. You cannot secure what you cannot see. Deploy connection-layer monitoring to discover every endpoint your agents reach.

2. Implement default-deny. The Greywall holds all unknown endpoints. Agents should only reach explicitly approved destinations.

3. Scope per agent. Each agent gets a connection profile with only the endpoints it needs. Nothing else resolves.

4. Monitor continuously. Alert on new connections, unusual patterns, and unapproved MCP server access.

5. Audit everything. Maintain a tamper-evident record of every connection decision for compliance and incident response.

Reduce Your Agent Attack Surface

Agent Connection Control from Securd implements all five steps at the connection layer. Deploys as a resolver setting.