How Cryptographic Data Enforcement Contains the MCP Blast Radius

Enterprise adoption of AI agents running over the Model Context Protocol has outpaced the security controls around them. Two recent incidents make the problem concrete.

In March 2026, Oasis Security published the "Claudy Day" chain, combining invisible prompt injection with data exfiltration against a default Claude deployment. In April 2026, CVE-2026-23744 gave attackers remote code execution on the MCPJam Inspector with a CVSS of 9.8. The pattern is the same in both cases: an agent with legitimate credentials, acting on injected instructions, reads and moves data its operator never intended to expose.

The defensive gap is structural, not operational. OWASP reports that 73 percent of production AI deployments contain exploitable prompt injection vulnerabilities, and only 34.7 percent of organizations have deployed any dedicated defenses. The NIST AI 100-2e2025 adversarial machine learning taxonomy documents prompt injection as a persistent threat class with no general mitigation.

Network segmentation does not constrain an agent that is already on the inside. Identity-layer controls authorize the agent, not the instruction. Endpoint telemetry observes the exfiltration after it has occurred.

The MCP blast radius problem

MCP is a productivity primitive. It gives an agent access to databases, file systems, internal APIs, messaging platforms, and SaaS connectors through a single protocol. Every capability added to the agent expands the surface an injected prompt can reach.

Unit 42 has documented indirect prompt injection in the wild through web content, and the Palo Alto Networks analysis of MCP sampling identifies the same vector through tool responses. This is not a model-provider problem. It is a data-plane problem.

Lattix treats the MCP plane the way zero trust treats the network: assume the request is hostile and enforce policy at the data object. Every file, dataset, and record that crosses an MCP tool boundary carries its own attribute-based access control (ABAC) policy, cryptographically bound to the object through ML-KEM-768 key encapsulation and content-addressed storage (CAS).

An agent that presents the correct identity and the correct request attributes receives a wrapped data key. An agent whose request attributes do not satisfy the policy receives nothing, regardless of what its connection privileges suggest. ABAC enforcement fails closed by default.

Lineage turns post-incident analysis into pre-incident evidence

Containment is necessary but not sufficient. Security teams need to know, to the object, what an agent touched, when, with what attributes, and under which policy version.

Lattix records every access decision in a Merkle-tree lineage chain stored in CAS, producing an immutable record that cannot be edited after the fact. When an agent misbehaves, the investigation is a lookup rather than a reconstruction.

The CISA Zero Trust Maturity Model's cross-cutting capability for visibility and analytics, and NIST SP 800-207's requirement that all data access and other security processes be logged for continuous analysis, both demand this level of evidentiary fidelity. Bolt-on SIEM integration does not produce it.

The same lineage structure supplies the data provenance required by the emerging regulatory posture. The NIST AI Risk Management Framework, the EU AI Act's high-risk system documentation obligations, and the CMMC 2.0 Level 3 audit requirements all converge on a single operational question: prove what data was used, by what process, under what authority. A verifiable lineage chain answers that question without manual reconciliation.

Post-quantum exposure is on the same timeline

The MCP surface and the post-quantum transition are not separate problems. Any data an agent reads today, including data it exfiltrates, is a candidate for harvest-now-decrypt-later against current-generation encryption.

CNSA 2.0 sets a January 2027 compliance checkpoint for National Security Systems, with full migration by 2030. NIST IR 8547 deprecates quantum-vulnerable algorithms from federal standards by 2035, with high-risk systems expected to transition far earlier.

Organizations that expose MCP-accessible data under ECDH or RSA key establishment are exposing it to an archival adversary with a multi-year decryption window. The harvest-now-decrypt-later window is open today.

Lattix implements ML-KEM-768 and ML-KEM-1024 natively at the object layer within the zero trust data fabric (ZTDF). Every ABAC-wrapped data key is post-quantum key encapsulation from the point of write. This is not a migration task for the data protected this way. It is the default.

What operators should change now

Three actions reduce MCP exposure without waiting for a reference architecture to standardize. First, classify data that is reachable by any agent, and require ABAC policy metadata on every object in that classification.

Second, move the enforcement point from the network or identity layer to the data object. An agent that cannot decrypt without attribute-compliant authorization is an agent that cannot be coerced into exfiltration through prompt injection, regardless of its connection privileges.

Third, require lineage evidence as a release gate for any MCP-connected system reaching production. If the access cannot be proved, the access is not authorized.

The operational lesson from March and April 2026 is that the perimeter has moved inside the agent. Controls that assume the agent is a trusted subject are obsolete. Cryptographic enforcement at the data object, with attribute-aware policy evaluation and immutable lineage, is the enforcement model that survives an agent acting on instructions the operator never wrote.