TL;DR: Your CASB, EDR, DLP, and network monitoring were built to watch people and devices. AI agents talk to their tools through MCP, which runs on the same web traffic and login tokens your normal apps already use. So agent tool calls look ordinary and slip right past. The fix is a logging checkpoint in the path between agents and tools.
A large credit union's security team asked me one question in May 2026. Could any tool they owned actually see what their AI agents were doing? Nobody on the call had an answer.
They'd already bought the tools that were supposed to see it. Those tools were looking the wrong way.
Why can't your existing tools see AI agent activity?
Your security stack watches the things it was built to watch. It watches people signing in. It watches endpoints and the data moving across them. An AI agent calling a tool isn't either of those, so it doesn't show up.
Here's the stack most teams lean on, and what each part actually looks at:
CASB (cloud access security broker), which watches which cloud apps your people log into
EDR (endpoint detection and response), which watches what happens on laptops and servers
DLP (data loss prevention), which watches for sensitive data leaving
Network monitoring, which watches traffic patterns for odd behavior
None of them were designed for an agent that pulls a batch of records from one tool and hands them straight to another. That path is new. The tools predate it.
What does it mean that MCP evades visibility?
MCP is the Model Context Protocol, the open standard agents use to call tools and pull data. It's how an agent asks a system to do something on its behalf.
Here's the part that catches teams off guard. MCP runs over HTTPS, the same secure web traffic your browser uses, and it authorizes calls with OAuth 2.1 tokens, the same kind of login token your normal apps carry. So when an agent asks a tool to export a customer list, that request looks like any other app making a routine web call.
Your CASB sees a web session. Your DLP sees an authorized transfer. Nothing flags it, because the call looks completely normal. The agent didn't break in. It walked through the front door with a key it was handed.
The NSA said as much in its June 2026 guidance on MCP security, which walks through why bearer tokens and standard web transport make agent calls hard to tell apart from ordinary traffic. You can read the NSA's MCP security guidance for the full breakdown. This is the same shift behind why security teams now ask about MCP before they bring it in.
How often does this blind spot actually show up?
This isn't a one-off. I ran three client calls between February and May 2026 where the same problem surfaced, from three companies that share almost nothing else.
February 16, 2026. A global manufacturer found agent connections by looking at what showed up on endpoints, because nothing else caught them.
May 11, 2026. A mid-size investment bank went hunting for shadow agents after API keys turned up sitting in GitHub.
May 26, 2026. A large credit union asked flat out whether their tools could see agent tool calls at all, and couldn't answer their own question.
Three different industries, and the same blind spot in each. That's the pattern I keep seeing, and it's the reason this post exists instead of a shrug.
The through line is simple. These teams weren't careless. They had real security programs. The programs just couldn't see a layer that didn't exist when they were built.
What should you do about invisible agent traffic?
Stop trying to spot agent calls inside tools that were never going to catch them. Put something in the path instead.
The control that works is a policy enforcement point, a checkpoint that sits between your agents and their tools and decides whether each call goes through. In the MCP world that's usually an MCP gateway or proxy. Every agent call routes through it, so every call gets logged.
Here's what that checkpoint buys you:
A record of every tool an agent touched, so you can answer "what did it do" after the fact
An allow-list of which MCP servers agents are even permitted to reach
A scoped identity for each agent, instead of a shared key that hides who did what
One accountable human tied to each agent, because an agent can't own the risk itself
Two of the five Agentic Trust Framework elements map straight onto this. Behavioral Monitoring is the watching, knowing what normal looks like so you can catch what isn't. Segmentation is the fencing, keeping each agent to the tools and data it actually needs. Miss the checkpoint and you lose both at once.
Start the way you'd start with finding shadow AI before it finds you. Assume there's more running than you can see, and build the visibility before you build the trust.
Key takeaways
AI agents call tools through MCP, which rides on ordinary web traffic and login tokens, so your existing tools read agent activity as normal.
CASB, EDR, DLP, and network monitoring were built for people and devices, not for agent-to-tool calls.
The same blind spot showed up on three separate client calls between February and May 2026, across three very different companies.
The fix is a checkpoint in the path, an MCP gateway that logs every call, allow-lists the servers, scopes each agent's identity, and ties each one to a person.
Frequently asked questions
Does MCP have any built-in security?
Some. The Model Context Protocol specification includes OAuth 2.1 for authorizing calls. It does not force logging, and it does not watch what agents do at runtime. Those are left to whoever sets up the server, so most of the safety depends on how each team wires it up.
Isn't this just shadow AI by another name?
It's related, but sharper. Shadow AI is about the agents and apps you don't know are running. This is about agents you do know about, doing work your tools still can't see. You can approve an agent and still be blind to what it calls.
Can't I just block MCP until we're ready?
You can try, and it tends to backfire. When the safe path is too hard, people route around it, the same way they did with shadow IT. A checkpoint that logs and allow-lists beats a wall that gets bypassed.
The short version
Your tools aren't broken. They're aimed at a world where people and devices did the work. Agents changed who's making the calls, and the calls now look like normal traffic. Until you put a checkpoint in the path, you're trusting a layer you can't see. Build the visibility first, then decide what to trust. A free AI agent readiness check is a fast way to find out how much of that layer you can see today.