← Back to writing
AIAgentic AISecurityNational SecurityMCP

Agentic AI in the Enclave: Decision Advantage Is Bought on Credit, and the Bill Is Attack Surface

12 min read
Agentic AI in the Enclave: Decision Advantage Is Bought on Credit, and the Bill Is Attack Surface

Agentic AI is sold into national security as an OODA-loop compressor. Every stage of the loop you delegate is a stage an adversary can reach through, on plumbing whose maintainers say it cannot make a human's consent binding on the wire.

Taking the Delegated Loop Apart

Agentic AI is being sold into the national security community as an OODA-loop compressor: decision advantage measured in seconds saved. Those seconds are real. They are also bought on credit, because every stage of the loop you delegate to an agent is a stage an adversary can reach through, on plumbing whose maintainers state plainly that it cannot enforce your consent model at the protocol level.

The framing is doctrinal here, not vendor noise. Decision advantage runs through the 2024 National Defence Strategy (Department of Defence, 2024), and the Australian Public Service Commission's own case study on Australia's Defence Artificial Intelligence Centre reports Defence pursuing exactly that (Australian Public Service Commission, 2025). So this piece does what a business case skips: it takes the delegated loop apart a stage at a time, asking at each one what authority you handed over and what that authority looks like from the other side of the wire.

If the plumbing will not make a human's consent binding, whose second are you saving, yours or the adversary's?

Observe: The Input You Do Not Control

An agent earns its keep at observe by reading more than a person can: feeds, repositories, case records, web pages, documents pulled from a share. All of it arrives as text from somewhere you do not control, and a language model has no reliable way to separate an instruction from data when both arrive in the same channel. That is not a defect awaiting a patch. It is the interface working as specified. OWASP catalogues it as LLM01, in direct and indirect forms, and pairs it with LLM06, excessive agency (OWASP Gen AI Security Project, 2025).

Indirect injection is the version that should worry an intelligence architect. The hostile instruction rides in on the material the agent was pointed at, a report, a page, a field in a feed, rather than arriving from your analyst. MITRE now carries a prompt-injection case study against a mainstream enterprise AI assistant in ATLAS, its ATT&CK-style knowledge base of adversary techniques against AI systems (MITRE, 2026). Documented and mapped, not hypothesised.

Compress observe, and you have widened the aperture through which an adversary writes to your agent. Those are the same act.

Orient: The Tool Descriptions Nobody Reads

At orient, the agent works out what to call. It makes that decision by reading tool metadata that a server supplies: names, descriptions, parameter documentation. Almost none of it is ever read by a human, and all of it is trusted input to the model's reasoning.

  • Tool poisoning: instructions concealed in a tool's description, so the thing the agent reads to decide how to act is the thing that turns it.

  • Rug-pull: a tool definition mutates after you approved it, so yesterday's safe integration is today's open door and nothing on your side changed.

Two 2025 vulnerabilities in Anysphere's Cursor, a widely used AI developer tool, make both concrete. MCPoison (CVE-2025-54136) allowed an already-approved MCP configuration file to be modified afterwards and re-executed, giving persistent code execution; the National Vulnerability Database scored it 8.8 high, while GitHub, as the assigning authority, scored it 7.2 (National Institute of Standards and Technology, 2025b). CurXecute (CVE-2025-54135) is more precisely an indirect prompt injection that writes the MCP configuration, which then auto-executes; the National Vulnerability Database scored it 9.8 critical and the assigning authority 8.5 (National Institute of Standards and Technology, 2025a). That second chain is this article's thesis in miniature: poisoned input at observe becomes a tool definition at orient becomes execution at act, with no person in the path.

Both are implementation flaws in one product, not a protocol-wide remote-code-execution hole, and neither is an enclave breach. Precision matters here. There is no public, confirmed case of a prompt-injection or MCP exploit inside an Australian classified enclave, and I am not implying one. The synthesis here, OODA compression read against MCP attack surface, is my own analysis rather than a reported consensus. Naming a foreseeable risk before it lands is the whole job.

The Model Context Protocol has become the common way to wire models to tools and data, and its specification opens its security section with four key principles for implementers: user consent and control, data privacy, tool safety, and controls on model sampling. Then, in its own voice: "While MCP itself cannot enforce these security principles at the protocol level, implementors SHOULD:" (Model Context Protocol, 2025).

Read that narrowly, because the narrow reading is the worse one. This is no blanket admission that the protocol carries no security. It is a statement that the protocol cannot make a human's consent binding on the wire, which is the exact control a cleared reader was counting on at the decide stage.

The specification's maintainers have a strong answer to that, and it deserves stating at full strength. MCP focuses solely on the protocol for context exchange; it does not dictate how an application uses a model or manages the context it is handed. Nor is it a bare pipe: the architecture separates a data layer over JSON-RPC 2.0 from a transport layer that manages communication channels and authentication, and the authorisation specification is normative, requiring OAuth 2.1, resource indicators under RFC 8707 and protected resource metadata under RFC 9728 at MUST level, and forbidding token passthrough outright (Model Context Protocol, 2025). Authorisation is OPTIONAL for MCP implementations by design, because a server speaking STDIO on a local machine, or an operator running a bespoke transport wholly inside an existing trust boundary, gains nothing from being forced into an OAuth deployment. On that account, an implementer who wires an MCP client into sensitive systems and enables none of it has not been let down by the protocol. They declined the controls it already ships.

I grant nearly all of that, and the argument is better for granting it. MCP was never a policy engine; blaming the wire for a missing lock aims at the wrong target, and specifying what sits above the wire has always been the deployer's job. Here is the part I will not grant. OPTIONAL is a word an accreditation authority cannot work with. In a classified enclave, an authorisation layer a compliant implementation may lawfully omit, sitting underneath a consent model the specification says it cannot enforce, is a policy gap by construction. The NSA puts the operational half of it more bluntly: MCP "currently lacks support for exchanging Role Based Access Control (RBAC) permissions at instantiation, making it difficult to enforce or verify access boundaries between tasks or services" (National Security Agency, 2026).

The same agency is candid about how the field got here: "MCP's rapid proliferation has outpaced the development of its security model. Much like early web protocols, MCP was released with a flexible and underspecified design" (National Security Agency, 2026). When a signals intelligence agency writes the security design considerations for your plumbing, the plumbing has stopped being a detail.

Act: The Boundary the Gate Never Sees

Act is where the loop stops being a reasoning exercise. Put it where it matters most, at the classification boundary, and the control we rely on there carries an assumption baked into its design: a person reviews what crosses. The bypass works through an agent host being handed a tool that already has reach on both sides of the line: a federated search connector, a replicated index, an integration built years ago for a reason nobody disputes. Each of those was approved on its own terms, and each becomes a limb the moment an agent can call it. So the consequential traffic never presents at the gate as traffic. The gate never fires, because on that path it has nothing to inspect, which is worse than being defeated: a defeated control leaves a trace.

I flag this one as reasoning rather than citation: the joint guidance does not address cross-domain solutions, and I have no primary source that does. The mechanism is not exotic, though. It is excessive agency plus indirect injection, running across two systems that sit on different sides of a line.

The tool call crosses the boundary the cross-domain solution was built to guard. The only control left in the path is a broker you have to build on purpose.

What the Guardrails Actually Buy

A lot, and never everything. Layer an input filter, a tool allow-list, a human approval step on consequential actions and an output scan, and one number moves: the share of injected instructions your stack refuses. It moves a long way at first, then barely, and no stack I would put my name to refuses every one. The curve below is illustrative rather than a benchmark: the diminishing return and the ceiling short of a hundred are structural claims, and the figures are there to show the shape. Defence in depth is worth every cent, and it is also an admission that you are managing a residual rather than closing it. Anyone selling you a control that "solves" prompt injection is selling you the brochure.

This is where the decision advantage instinct does its damage. Guardrails cost time, and the human approval step at decide and act is exactly the second you were promised you would save. So the pressure to strip them out comes from the same place the capability was demanded. Buy now, pay later, and the interest is charged in incidents.

Stack the guardrails and the injected-instruction refusal rate climbs, with diminishing returns. It never reaches the top. The residual is what you carry inside the wire.

Where It Actually Breaks

It rarely breaks at a single stage, and when it does, the stage was already carrying somebody else's authority. Each one alone is survivable: an injected document with nothing to act on is a bad read, and a broadly scoped tool with no hostile input is an audit finding. It breaks at the joins, because delegation is what removes the person who used to stand between them. Compressing the loop is the same act as removing the checks the old loop's slowness paid for, and that is why "she'll be right" is not a control.

The good news is that the answer is largely written down, and Australia has its hands on the pen. The joint guidance on careful adoption of agentic AI services names ASD's Australian Cyber Security Centre first among its co-authoring agencies, ahead of CISA, the NSA, Canada, New Zealand and the UK (Australian Signals Directorate's Australian Cyber Security Centre et al., 2026). If you want the tell rather than the billing, read the spelling: the document is hosted on a US Department of Defense server and does not contain a single American spelling. Analyse, behaviour, organisation, authorise, all the way through. Narrowly stated, it may be the first coordinated multi-government guidance on agentic AI specifically; it is certainly not the first on AI security, since ASD's ACSC led Engaging with artificial intelligence with international partners back in January 2024 (Australian Signals Directorate's Australian Cyber Security Centre, 2024). What follows is the fix-forward, and none of it starts with buying the fastest agent in the room.

  • Fold agentic AI into the security model you already run. The joint guidance asks organisations to align agentic AI risks with their existing security model and to address AI security "rather than treating it as a separate or standalone discipline. AI systems are fundamentally IT systems" (Australian Signals Directorate's Australian Cyber Security Centre et al., 2026). A parallel AI governance stack is how you end up with two sets of controls and one set of gaps.

  • Ask whether the process should exist at all. The same guidance tells organisations to consider a full spectrum of solutions for repetitive tasks, "including reducing or eliminating low-value processes, which may be lower risk compared to agentic AI solutions". Six agencies with a signals intelligence pedigree are saying the alternative to an agent is sometimes deleting the work, which makes speed versus safety a false binary. Automating a process nobody should be running buys you the attack surface and none of the advantage.

  • Start where it cannot hurt you. Begin with low-risk, non-sensitive use cases and earn your way up. The urge to point agents at the crown jewels first is the urge to invert the advice.

  • Deny broad reach by default. Avoid unrestricted tool access to sensitive data and critical systems. Scope every tool to its task, allow-list rather than deny-list, and make "what could this agent reach if it were turned against me" the design question rather than the post-incident one.

  • Put a broker in the path, because the protocol does not mandate one. MCP leaves you to select or build the layer that mediates every tool call, logs it and makes it reconstructable, and it does not yet standardise gateway or proxy behaviour. Standardisation is in flight rather than absent: enterprise-managed authorisation has landed as an extension that moves access decisions into the enterprise identity provider, and gateway patterns sit on the maintainers' roadmap as open problems. Select for that trajectory, and own the log yourself either way.

  • Keep a person who can answer for the act. Defence's policy settings bind AI-enabled decisions to legal compliance and human accountability (Department of Defence, 2026). An agent acting across a boundary with nobody able to answer for the act is not a capability; it is an unowned risk with a badge on it.

Note: this is not a comprehensive treatment of agentic security, because most readers would not thank me for one. It carries the load-bearing argument, and the companion interactive lets you drive the loop rather than take my word for it.

The brochure is right that agents compress the loop. What it leaves off is that the compression and the exposure are minted at the same four stages, by the same act of delegation, on plumbing that has told you in writing what it will not enforce. So when the business case lands on your desk with the seconds saved in the executive summary, here is what I would ask before signing it: which stage of this loop have you agreed to let a stranger write to, and who in your organisation is accountable for what it does next?

Thanks for reading.

The views expressed in this article are my own and do not represent those of my employer or any of my clients.

Interactive: walk the loop and see each stage buy speed with one hand and open a named attack surface with the other. Turn the guardrails on, and the red never quite empties.

References

Related reading

17 min read2 likes

The Undeclared Dependency: Every Technical Supply Chain Has a Strait of Hormuz

AI cannot secure a supply chain that has never been written down: detection coverage has a ceiling set by what you have actually declared, and no model can flag an edge it was never shown. Australia's fuel stocks, your cloud builds, and the defence industrial base are all exposed through the same weakness, dependencies nobody wrote down, and the unglamorous act of declaring the graph and then verifying it continuously is the actual security control. The clever model you point at the problem comes a distant second.

Critical InfrastructureSupply ChainAINational SecurityArchitecture
11 min read1 like

Exempt by Design: The AI Governance Gap in the National Intelligence Community

It is fair to assume the agencies wielding AI on the most consequential decisions carry the tightest rules governing it; in Australia, for the national intelligence community, that assumption is exactly backwards. The mandatory framework for government AI, the Digital Transformation Agency's policy now at v2.0 with a mandatory use-case register, exempts the Defence portfolio and the national intelligence community (Digital Transformation Agency, 2025). The National AI Plan shelved the proposed mandatory high-risk guardrails and stood up an AI Safety Institute instead (Department of Industry, Science and Resources, 2025). What is left for the community is point-in-time authorisation under the Protective Security Policy Framework and an oversight office that has appointed a single Chief AI Officer (Inspector-General of Intelligence and Security, 2025).

AIGovernanceNational SecuritySovereign AIOversight
9 min read1 like

Starved by Design: The Sovereign AI Paradox

Sovereign AI is being pitched to the national security community as a straightforward capability upgrade, yet the paradox holds regardless of vendor: the more classified the network, the worse the artificial intelligence running on it tends to be, because every technique that makes modern AI capable, live retrieval, fine-tuning, a connection to a frontier model, needs data to move, and a classified network's entire purpose is to stop data moving. That gap is a structural feature of how these systems are currently built, not simply a funding shortfall Australia can spend its way out of, though it narrows as local techniques improve. As Australia invests in sovereign and next-generation capability through programs like the Australian Signals Directorate's REDSPICE and the National AI Plan (Australian Signals Directorate, 2022; Department of Industry, Science and Resources, 2025), we owe ourselves an honest conversation about what a sealed enclave can and cannot do.

Sovereign AINational SecurityCloudAIArchitecture