The Model Context Protocol is the "USB-C for AI". It allows agents to discover and use tools through one interface. Adoption reached 97 million monthly SDK downloads. By mid-2026, researchers identified 15,930 public MCP servers. Many of these servers operate without enterprise oversight. When engineers deploy AI agents that connect to internal systems through the Model Context Protocol without strict governance, they inadvertently expand their attack surface to include thousands of unvetted servers that carry significant command-injection or remote code execution flaws.
Token-based rate limiting failures
Traditional request-per-minute caps fail to address LLM resource consumption. A single prompt to a 70B parameter model consumes thousands of tokens. This differs from a 20-token prompt to a 7B model. Engineers who rely on request counts alone see unexpected bills. One user can trigger large-scale backend processing through long-form prompts or multi-step agents. Token-based rate limiting tracks total tokens processed, model size, and request type. This provides fairer enforcement across varied workloads.
LLM providers enforce limits across three dimensions: requests per minute (RPM), tokens per minute (TPM), and requests per day (RPD). TPM is usually the first ceiling a user hits. A single request with a 40,000-token document can burn through a minute-level token budget while the request count barely moves. To manage this, engineers use different algorithms. The token bucket algorithm allots a bucket of tokens that refills at a fixed rate. This lets a system absorb short bursts without dropping requests instantly.
Other methods include the fixed window and the sliding window. Fixed window counters reset at clock boundaries. This creates a thundering-herd problem at the reset edge when queued requests fire at once. Sliding window counters smooth that edge by tracking a rolling timeframe. This requires more computation. Engineers also use quota partitioning to split capacity across tenants or workloads. This prevents the noisy-neighbor problem where one consumer exhausts shared capacity.
Prompt injection and insecure output handling
The OWASP Top 10 for LLM Applications identifies prompt injection as a primary threat. Direct prompt injection overwrites the system prompt to access backend systems. Indirect prompt injection uses external websites or files as input. Attackers exploit insecure output handling to trigger cross-site scripting or server-side request forgery. Organizations must validate any output from the LLM before letting it drive other functions. They should apply a Zero Trust security model and treat the LLM like any user or device.
Data poisoning also remains a threat. Malicious competitors may manipulate data used for training to hinder accurate results. Organizations must secure the data supply chain and verify the legitimacy of data sources. They must also prevent the model from scraping data from untrusted sources. LLM applications may also reveal confidential data in responses. This includes sensitive customer information or intellectual property. Data sanitizing and scrubbing are necessary to prevent these disclosures.
| Risk Type | Attack Method | Mitigation Strategy |
|---|---|---|
| Prompt Injection | Direct/Indirect manipulation | Access control and human oversight |
| Insecure Output | XSS, CSRF, SSRF, RCE | Zero Trust and output validation |
| Data Poisoning | Training data manipulation | Data supply chain security |
| Denial of Service | Resource-heavy operations | API rate limits and input sanitization |
| Supply Chain | Plugin/Third-party risks | Vetting suppliers and inventory management |
| Information Disclosure | Sensitive data leakage | Data scrubbing and localization |
Agentic agency and tool misuse
Developers often give LLM applications agency to act automatically. This agency causes problems when an LLM produces unexpected outputs due to attacks or hallucinations. An agent with permission to update a record can access files it should not see. Organizations must limit the functionality and permissions of plugins to the minimum levels necessary. They should also require humans to authorize certain actions before the application takes them.
The Model Context Protocol increases this risk. Many MCP servers carry flaws that allow for remote code execution. These servers are often deployed with no enterprise oversight. This creates "shadow MCP" integrations where tools connect to core systems without governance. Every AI connection to a core system needs a decision on what data it touches and who owns it. Agents should get read-only, scoped access unless a reviewed reason exists to grant more.
How can an organization ensure that an autonomous agent does not accidentally execute a malicious command through a discovered MCP server?
Non-human identity sprawl and access control
Organizations face non-human identity sprawl as they add more AI tools. Each service account creates a potential attack surface. Managing dozens of teams with shared OpenAI keys creates an operational risk. Access control governs who can use which models, at what budget, and with what tools. Bifrost uses virtual keys to carry model filtering, provider restrictions, budgets, and rate limits. This allows teams to use scoped, per-user credentials instead of shared secrets.
Bifrost also includes role-based access control with three system roles: Admin, Developer, and Viewer. It integrates with identity providers like Okta and Microsoft Entra through OIDC. This ensures that access maps to corporate identity rather than shared secrets. Access profiles let a platform team define a reusable policy once. They can then auto-allocate a per-user virtual key to everyone in a specific role.
You know the risks of shared API keys. Using a centralized gateway reduces the effort of managing many microservices. It also simplifies fallback routing. A single exhausted provider does not take down the whole system because the gateway handles the routing.
Cloudflare AI Gateway limitations
Cloudflare AI Gateway provides an edge-based proxy with global scale. It uses caching to reduce latency and visibility into token usage. It also includes tools for content moderation and data loss prevention. However, Cloudflare AI Gateway does not offer multi-provider failover routing or hierarchical budget controls. It works best for teams already on Cloudflare’s infrastructure. If your traffic cannot transit a third-party SaaS edge, Cloudflare is ruled out.
Cloudflare AI Gateway is a convenience tool rather than a complete governance solution. It helps with rate limit mitigation through caching and analytics. It is a managed service that runs on the Cloudflare global edge network. This means there is no infrastructure for the user to deploy or maintain. For developers who want convenience over ownership, this is a benefit. For enterprises that require strict data sovereignty, this is a drawback.
LiteLLM provides a different approach. It is a self-hosted, MIT-licensed proxy. It is ideal when data must stay in the local environment. LiteLLM supports 100 plus providers and includes retry and fallback logic. It allows for budget and rate limit management at the proxy level.
| Capability | LiteLLM | Cloudflare AI Gateway |
|---|---|---|
| Deployment | Self-hosted | Managed/Edge |
| License | MIT | Usage-based |
| Provider Support | 100+ | 20+ |
| Sovereignty | High | Low |
| Primary Use Case | Data Sovereignty | Ease of Use |
Platform-specific vulnerabilities in AI services
AI platforms contain unique vulnerabilities in their implementation of AI services. The ServiceNow AI platform contains code injection flaws (CVE-2026-18885) and improper access control flaws (CVE-2026-18886). It also has a SQL injection flaw (CVE-2026-74820). These flaws allow unauthenticated users to execute arbitrary code or modify instance data.
PaperCut NG and MF servers face authentication bypass (CVE-2026-81578) and remote code execution (CVE-2026-82078). These vulnerabilities affect all previous versions of the software. SonicWall SMA 1000 devices face SSRF (CVE-2026-83548) and command injection (CVE-2026-83549). These flaws allow for unauthorized access and arbitrary OS command execution.
| Vulnerability Type | CVE ID | Affected System |
|---|---|---|
| Code Injection | CVE-2026-18885 | ServiceNow AI Platform |
| Improper Access Control | CVE-2026-18886 | ServiceNow AI Platform |
| SQL Injection | CVE-2026-74820 | ServiceNow AI Platform |
| Authentication Bypass | CVE-2026-81578 | PaperCut NG & MF |
| Remote Code Execution | CVE-2026-82078 | PaperCut NG & MF |
| SSRF | CVE-2026-83548 | SonicWall SMA 1000 |
| Command Injection | CVE-2026-83549 | SonicWall SMA 1000 |
Handling 429 errors and provider overload
Naive retry logic turns minor issues into outages. A 429 error means the user hit a rate limit. A 5xx error means the provider is overloaded. Hammering an overloaded provider with retries makes things worse. Organizations should use exponential backoff with full jitter. Full jitter uses a randomized delay to avoid synchronized retry storms across a fleet.
Engineers must also honor the Retry-After header when a provider sends it. They should cap retry budgets by request deadline rather than attempt count. A chat request waiting eight seconds should not have the same retry budget as a background job with a ten-minute deadline. Organizations should also open a circuit breaker after a threshold of failures. This prevents the system from hammering a struggling provider.
Quota-aware degradation is another method to manage exhaustion. This feature is configured at the model API level. When a token quota is about to be exhausted, the system downgrades requests to a fallback service. This prevents request failures when a budget is low. A threshold of 10% is a common recommendation for this trigger. A more aggressive policy might set the threshold at 5%. A conservative policy for high-availability scenarios might set it at 20% or 50%.
