Every agent framework now ships tool calling, and MCP has made it trivial to plug a model into hundreds of third party servers. That convenience moved the security boundary somewhere most teams are not looking: not the model, not the prompt, but the tool layer underneath. A poisoned tool description, a mutated schema after install, or a server that quietly reads outside its declared scope will bypass every guardrail sitting in front of the model, because the model was never the thing that got compromised. This session walks through what actually breaks in production agent systems and the controls that hold. I will cover tool poisoning and rug pull attacks against MCP servers, indirect prompt injection arriving through retrieved content and tool output, and the combination of private data access, untrusted input, and external communication that turns a useful agent into an exfiltration path. Then the defensive half: auditing MCP servers before install and continuously after, pinning and diffing tool schemas, enforcing least privilege on non human identities that agents run as, and the architectural rule that has held up best across the systems I have shipped, which is that the model reasons but deterministic, unit tested code enforces every policy decision. That rule comes from arithmetic rather than preference: five chained steps at ninety percent accuracy each lands near fifty nine percent end to end, so anything you need to be right has to leave the probabilistic path. Attendees will leave with a concrete threat model for the agent tool layer, a checklist for evaluating any MCP server they are about to trust, and detection and enforcement patterns that can be dropped into an existing agent stack without rewriting it. Examples are drawn from open source tooling I maintain and from production AI security platforms deployed in enterprise environments.
Pranav Saji is an AI and AI security engineer in the San Francisco Bay Area, most recently Head of AI Security at Symosis Security, where he was the sole engineer on a suite of production AI security and governance platforms covering prompt injection defense, MCP auditing, agentic red teaming, and non human identity governance. He is a two time startup CTO and a Y Combinator F24 founding engineer, and has delivered machine learning and security engineering work for LinkedIn and Fortune 500 clients at Deloitte. He maintains MCPGuard and AgentGuard, open source security tooling for the agent era, and writes for HackerNoon on prompt injection and MCP supply chain attacks. He is a selected trainer at OWASP Global AppSec USA 2026 on AI agent security and the tool layer attack surface, and a core judge at the USAII Global AI Hackathon 2026.
