Moving past the chatbox: The hidden risks of agentic AI and MCP in enterprise infrastructure

In Singapore, Hong Kong, and across the APAC region, the corporate adoption of Generative AI has completed its initial trial phase. Over the past year, enterprise technology leaders have realised that simple internal chatbots offer limited structural value. The real ROI lies in the next evolutionary phase: fully autonomous AI agents.

We are shifting from static AI “assistance” to dynamic “decision execution.”

However, as organisations rush to deploy autonomous agents that can pull enterprise context and execute live API actions across legacy silos, a critical infrastructure gap has emerged. In the race for velocity, many CISOs are inadvertently leaving the enterprise backdoor wide open.

The protocol shift: Why legacy security is blind to the semantic layer

The rapid rise of the Model Context Protocol (MCP) has changed the architecture of AI implementation. MCP allows large language models to seamlessly connect to secure, local data sources, development tools, and enterprise environments.

But from an infrastructure security perspective, this creates an unmanageable perimeter risk.

Traditional Web Application Firewalls (WAFs) and legacy Data Loss Prevention (DLP) systems operate at the network or packet layer. They are fundamentally blind to the semantic layer of LLM prompts and agentic workflows. They cannot parse what an autonomous agent is “thinking” or planning to execute.

When a localised agent leverages MCP to pull a massive code repository, database query, or customer PII profile to ground its context, it automatically bundles that proprietary data. The moment that bundle is sent to a third-party, public cloud LLM for inference, your data ownership is permanently compromised.

Also Read: From chatbots to payment agents: AI’s next role in SEA commerce

The three structural blindspots of agentic infrastructure

Having spent over two decades building enterprise protection systems, from the early days at Bell Labs and Symantec to engineering data security architectures at Websense and IBM, I see the current LLM landscape repeating the fatal mistakes of the early cloud migration wave.

There are three immediate risks stalling enterprise AI from moving safely into production:

• The autonomy risk (shadow actions): Once an agent is granted execution rights via MCP to interact with internal databases, it becomes highly vulnerable to Prompt Injection. A malicious external input can hijack the agent’s logic, leading to unauthorised API execution or lateral escalation within your network. Post-incident auditing is simply too late.
• The privacy paradox: To make an AI agent useful, you must feed it deep organisational data. But traditional security models force a brutal trade-off: you either compromise on AI intelligence by withholding data, or you trade away data privacy by passing raw tokens across your corporate boundary.
• The FinOps nightmare: Autonomous agents operating in background loops frequently fall into execution deadlocks. A single looping agent misinterpreting a complex database schema can burn thousands of dollars in token expenditure within hours, while completely shattering your compliance audit trails.

Also Read: If AI can’t find your startup, does your startup exist?

Rebuilding the boundary: Inline, client-controlled governance

To unlock the true power of Agentic AI without exposing critical core assets, APAC enterprises must shift from reactive monitoring to proactive, runtime governance.

Security cannot act as the emergency brake on innovation; it must become the accelerator.

The industry requires a fundamental architectural upgrade: a centralised AI Access Gateway that deploys a client-controlled data plane directly at the boundary level.

Before an agentic prompt or an MCP resource payload ever hits an external LLM provider, the data plane must execute real-time, zero-trust token scrubbing. It must de-identify PII, strip sensitive API keys, and mask core proprietary source code locally, inside your domain. Once the model returns its response, the gateway dynamically re-identifies the tokens, allowing the local workflow to execute seamlessly.

Furthermore, this orchestration layer must feature circuit breakers to halt deadlocked agents and implement intelligent model routing, automatically offloading long-context, low-risk MCP tasks to highly optimised local open-source models to manage FinOps overhead.

As AI transitions from a novelty to the digital foundation of modern commerce, the question is no longer about which model is the smartest. The real question is: Who controls the data plane that keeps those models safe?

—

Editor’s note: e27 aims to foster thought leadership by publishing views from the community. You can also share your perspective by submitting an article, video, podcast, or infographic.

The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of e27.

Join us on WhatsApp, Instagram, Facebook, X, and LinkedIn to stay connected.