KDCube
← AI Industry News

Agents Become Insiders as MCP Gets Its Own Shield

Microsoft's expanded Project Perception treats internal AI agents as insiders under continuous supervision, with risk-scored, graduated runtime containment instead of one-time authentication. Radware shipped dedicated MCP Server Protection as attacks on agent-to-system seams grow, while vLLM's Day-0 support for NVIDIA'...

Highlights

  • Govinsiders
  • MCPattack surface
  • Modelsserving
  • Edgeon-device
  • Microsoft expanded Project Perception to treat internal AI agents as insiders needing continuous supervision, not visitors to authenticate once — with Guardian Agents, continuously scored Dynamic Agent Risk, and zero-authority Dynamic Permissions (Forkast).
  • Agent discovery now spans 60 local agent types (up from 25), including Claude Code, OpenAI Codex, and GitHub Copilot, bundled into Microsoft 365 E7 at $99/user/month (Forkast).
  • Radware launched MCP Server Protection, a purpose-built defense for Model Context Protocol servers against protocol abuse, tool enumeration, and AI-driven tool flooding (Security MEA).
  • vLLM's Day-0 support for NVIDIA's open Nemotron 3.5 Super VL puts a 120B mixture-of-experts (12B active/token) on a production serving stack — the model-ops counterweight to the week's governance rush (vLLM).

Key Signals

  1. Microsoft reframes the agent as an insider threatOct 19, 2026

    Project Perception's expansion drops the "authenticate at the door" model: Dynamic Conditional Access extends Entra so a rising risk score triggers graduated responses — block writes while preserving reads, narrow data access, require human approval, or isolate the runtime — with Dynamic Agent Risk even scanning chain-of-thought for intent drift (Forkast). This is a materially different posture from this week's identity-badge announcements: it assumes the credentialed agent is already inside and watches it continuously.

  2. MCP gets a dedicated protection layerOct 19, 2026

    Radware's MCP Server Protection targets the exact seam builders have been widening all year — the integration point between agents and enterprise systems — defending against authentication attacks, unauthorized tool interactions, and DoS against MCP infrastructure, with visibility into exposed resources and agent behavior (Security MEA). CTO David Aviv's framing is blunt: "every new connection also expands the attack surface," and Stacklok's 2026 survey pegs nearly half of software companies as running MCP in production.

  3. Serving, not just governingOct 15, 2026

    Amid the governance pile-up, vLLM shipped Day-0 support for NVIDIA's open Nemotron 3.5 Super VL — continuous batching, prefix caching, speculative decoding, and an OpenAI-compatible API behind a 120B MoE that activates 12B parameters per token (vLLM), claiming reasoning-class multimodal accuracy at roughly a fifth of the parameter count (unite.ai).

Why It Matters / What To Watch

  1. Runtime containment is eating static identity
    • If you issued agents scoped credentials this week, plan for the next layer: runtime risk scoring and automated, graduated containment that can revoke mid-task (Forkast).
    • Watch the pricing signal — folding Guardian Agents and Dynamic Permissions into an E7 SKU bundles containment with the model and Copilot, nudging buyers toward a single vendor's control plane (Forkast).
  2. Treat every MCP server as exposed infrastructure
    • Inventory your deployed MCP servers and their exposed resources before scaling connectors; tool enumeration and tool-flooding are now named, productized attack classes (Security MEA).
    • Pair protocol-level defense with behavioral monitoring of agent identities — the attack surface grows with each connection, not each agent (Security MEA).
  3. Keep a model-ops lane open
    • Teams running always-on or on-device agents should track the serving layer, not just the policy layer: Nemotron 3.5 Bolt E4B (4GB) is slated for Oct 23, extending the open edge-model lineup (unite.ai).
    • Validate open MoE models on a batching-and-caching stack like vLLM before committing inference budget (vLLM).

Quick Links