Written by Krishanu Borah.
Originally published by Akto.
If there's one product that has quietly embedded itself into how your employees actually work, it's Claude.
Two years ago, it was summarizing meetings. Today, it's reading local files, running shell commands, browsing the web with employee session cookies, and connecting to your Slack, GitHub, and production databases. What started as a productivity shortcut now operates with the same privileges as the person using it, and in many organizations, security teams never approved, governed, or even have visibility into that access.
When adoption outpaces oversight, risks start to show up.
Somewhere in your organization, a developer is feeding proprietary source code into Claude to speed up a refactor. A finance analyst is running revenue projections through Cowork with data pulled straight from internal dashboards. A legal team member is iterating on contract language in a Claude project alongside confidential deal terms. None of them filed a request with IT. None of them checked whether the data leaves your environment. You may not know it's happening. But it is.
Most organizations have no visibility and hence no guardrails in place, no SSO enforcement across these surfaces, no acceptable use policy. Without governance, there's no way to know what data is flowing through Claude, who's using it, or whether any of it complies with your regulatory obligations.
Enterprise projects in Claude let teams upload documents, share access, and wire in external data through connectors. Useful - until you realize these projects are becoming quiet repositories of sensitive information that nobody's watching. Which documents have been uploaded? Who has access to projects with sensitive files? Which connectors are active, and what have they touched?
Most orgs can't answer a single one. Claude projects carry enterprise-grade risk with consumer-grade visibility.
MCPs fundamentally change the security model because Claude no longer depends solely on information employees manually paste into prompts.
With connectors enabled, Claude can directly interact with systems like Slack, GitHub, Google Drive, Jira, and Notion. That dramatically improves productivity, but it also expands the blast radius of compromised workflows or over-permissioned integrations.
Most employees are not thinking about OAuth scopes or authentication boundaries when enabling these integrations. They simply want Claude to work seamlessly with their tools.
Security teams, however, need visibility into:
Without proper MCP security governance around authentication and connected systems, organizations lose visibility into expanding AI attack surfaces.
The idea of AI coworkers sounds exciting until you think about it operationally.
Once AI systems begin collaborating across tasks, tools, and workflows, the challenge shifts from employee AI usage to autonomous AI activity.
This creates new governance concerns:
The industry is rapidly moving toward AI systems that can execute workflows instead of simply responding to prompts. That means organizations need governance models designed for non-human identities and autonomous operations, not just employee monitoring.
Claude Code skills let users package reusable workflows, automate repetitive tasks, and customize how Claude behaves across projects. Claude treats them as trusted system prompts and follows whatever they say, including instructions the user never asked for. There's no sandbox. If Claude has shell access, so does the skill.
Snyk audited nearly 4,000 agent skills and found over a third had at least one security flaw. The ClawHavoc campaign seeded 335 malicious skills across platforms. Traditional scanners won't catch AI agent security risks hidden inside reusable skills and prompts, the "malware" is plain English telling the agent to exfiltrate your environment variables.
Veracode's testing found that in 52% of coding tasks, Claude's latest Opus model produced code containing a vulnerability - compared to roughly 30% for OpenAI's models. As Veracode's chief innovation officer put it, models are trained to write working code, "not to consistently apply the controls that make software secure." Less experienced developers won't catch what Claude gets wrong, and that insecure code is already reaching production unreviewed.
Then there's the tool itself. Check Point Research discovered three critical flaws in Claude Code (CVE-2025-59536, CVE-2026-21852) where simply opening a malicious repository could trigger hidden command execution on a developer's machine, no interaction required beyond launching the project. A stolen API key from one compromised developer could provide access to an entire team's shared resources. As Check Point put it, "a single malicious commit could compromise any developer working with the affected repository." Claude Code security becomes significantly harder when the platform itself can introduce vulnerable code and insecure execution paths. That's a compounding risk most security teams haven't accounted for.
Krishanu Borah is at Akto, the leading Agentic AI Security and MCP Security platform. Partners with Fortune 1000 security teams across financial services, technology, and manufacturing to govern the new era of Agentic AI at scale. Shapes Akto's product roadmap across continuous discovery, guardrails, and automated AI red teaming.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。