Executive Summary
In short:
- The problem: Security is the stated blocker for connecting AI agents to business systems, and the worry is justified. Researchers have reported dozens of vulnerabilities in the Model Context Protocol (MCP) ecosystem, including exposed servers, command injection and a backdoored package.
- The cause: Most incidents are familiar weaknesses, such as poor authentication, excessive permissions and unchecked software, in a setting where an AI can act on your behalf.
- The Australian angle: If an AI agent touches regulated or personal data, it can raise CPS 234 and CPS 230 questions for APRA-regulated entities, and Privacy Act questions for everyone else. Automated decision-making disclosure starts on 10 December 2026.
- The solution: Ask ten plain questions before any connection goes live, start with one read-only workflow, and choose a supplier who documents the build and transfers the knowledge to your team.
What's next?
Take the ten questions in this article to your IT lead or supplier this week and score every AI connection you already have. If you want a second opinion or a secure custom build, talk to C9 about scoping one workflow first.
Why Does Connecting AI to Your Systems Feel So Risky?
Your team has found a use for an AI agent, such as answering questions about invoices or summarising service tickets from live data. Then your IT lead asks the question that stops the project: "What stops it from reading, or doing, something it shouldn't?"
An AI agent connected through MCP can be given the ability to search your files, query your databases and act in your systems. If the connection is badly built, so is your risk position.
This article gives you ten questions to ask before connecting AI to your systems. They let you challenge a supplier or internal team without being an engineer.
In plain terms: MCP security is the set of controls that decide who or what an AI agent acts as, which tools and data it can reach, and how its actions are logged, limited and reviewed when it connects to business systems through the Model Context Protocol.
If you are still deciding whether you need MCP at all, start with our guide to MCP vs API vs direct integration.
Is the Security Worry Justified? What 2026 Research Found
MCP is an open standard that lets AI models use tools and data through one common interface. It spread quickly, and security research has followed.
What this means for you: Many incidents come from ordinary weaknesses. The AI raises the stakes because it can act quickly and at scale on whatever access it has.
How Do MCP Attacks Work? A Plain-English Guide
A few terms help in supplier conversations.
| Attack pattern |
Plain-English meaning |
Business consequence |
| Prompt injection |
Hidden instructions in content the AI reads, such as an email, web page or support ticket |
The AI follows an attacker's instructions instead of yours |
| Tool poisoning |
Malicious instructions hidden in a tool's description, which the AI loads automatically |
Data leaks or unwanted actions that nobody notices |
| Rug pull |
A tool is approved, then quietly changed afterwards |
An approval you gave last month no longer means what you thought |
| Supply chain compromise |
A booby-trapped MCP package or server from a public registry |
Your data is copied out by software you trusted |
The Cloud Security Alliance's AI Safety Initiative described tool poisoning in a July 2026 research note. It noted that the protocol has no native mechanism to detect it.
None of this means "do not use MCP". It means you need good answers to the questions below.
Ten Questions to Ask Before Connecting AI to Your Systems
These questions follow widely published checklists, including Stacklok's MCP security checklist. Each has a "good answer" and a "red flag" so you can judge the reply.
Access: who and what
1. Who is the AI acting as? Every action should trace back to a real identity, not a shared account. Good answer: each user or agent has its own credentials, remote servers use modern authentication such as OAuth 2.1, and tokens are short-lived. Red flag: "It uses the admin login."
2. What exactly is it allowed to do? Permissions should be set per tool, not per server, and should start read-only. Good answer: a written list of tools, with write and delete actions switched off until they are justified. Red flag: "It can access everything so it doesn't break."
3. Does a person approve anything that changes a record? Sending, paying, deleting or editing should need a human check, at least at first. Good answer: approval steps for high-impact actions. Red flag: the AI acts alone from day one.
Exposure: where it lives
4. Is the server reachable from the internet? Good answer: servers sit behind an authenticated gateway, use encrypted connections and are not open to the whole internet. Red flag: "We'll lock it down later."
5. Who built it, and what is inside it? Good answer: known publishers, pinned versions, reviewed code and an approved list of servers. Red flag: installing whatever a public registry suggests.
6. Can we trust the tool descriptions, and will we notice if they change? This is the main defence against tool poisoning and rug pulls. Good answer: approved tool definitions are recorded and re-checked, and any change triggers a review. Red flag: tools are approved once and never looked at again.
Data: what moves
7. Where are the passwords and keys kept? Good answer: a dedicated secrets store, short-lived tokens and a plan for rotating them in an emergency. Red flag: keys pasted into configuration files.
8. What data leaves our environment, and where does it go? Good answer: a data-flow map, with personal and sensitive information minimised, masked or excluded. Red flag: nobody can say which systems receive customer data.
Oversight: seeing and stopping
9. Can we see everything the AI did, and do we know which servers exist? You need logs of every tool call, stored where the AI cannot alter them, plus an inventory of every MCP server, including ones staff set up themselves ("shadow MCP"). Good answer: centralised logs, alerts and a maintained register. Red flag: "We think a few developers are using some."
10. Can we switch it off and carry on? You need a kill switch and a manual fallback. Good answer: a tested way to disconnect the AI and a documented way to run the process without it. Red flag: the business now depends on it with no exit plan.
Which Australian Obligations Apply? CPS 234, CPS 230 and the Privacy Act
The same ten questions double as evidence for Australian regulatory expectations. This is general information, not legal advice.
APRA-regulated entities: CPS 234 and CPS 230
CPS 234 covers information security, and a material incident carries a 72-hour notification expectation to APRA. An AI connection to a core system becomes part of that risk picture. CPS 230 adds weight on third-party service providers, with existing contracts due to comply by 1 July 2026.
In April 2026, APRA wrote to regulated entities after a targeted review of large banks, insurers and superannuation trustees. MinterEllison's commentary reports that APRA saw third-party AI risk as the biggest gap. The expectations it describes include monitored contract terms, mapped fourth-party dependencies and tested fallback plans. Read the letter itself before relying on this summary. For the evidence side, see our guide to CPS 230 and CPS 234 audit evidence.
Everyone else: the Privacy Act and automated decisions
From 10 December 2026, organisations that use personal information in programs that make, or substantially assist, decisions that significantly affect people must describe this in their privacy policy. It is a transparency rule, not a ban, and an AI agent connected to customer data may be in scope. Our guide to the automated decision-making audit sets out a six-step approach.
Beware the "AI Cowboy": Why Cheap AI App Builders Can Cost You More
AI app builders have lowered the barrier to creating software. For prototypes, that is a real benefit. The risk begins when a prototype quietly becomes a business-critical system that touches your data.
We use "AI cowboy" as an informal label for a builder who ships quickly with AI tools but with little engineering discipline, testing or documentation.
Why executives should care
The knowledge gap
| What a cheap AI app builder typically gives you |
What a business usually needs |
| A working demo |
A tested system with access controls |
| Generated code |
Code your team can read, maintain and review |
| Fast delivery |
A documented handover |
| A one-off output |
Capability that stays in your organisation |
The most important difference is learning. C9 builds knowledge transfer into delivery, with documentation and handover, so your organisation understands what was built, how it is secured and how to change it, and is not locked into one supplier.
A Practical Way to Start: One Secure Workflow
Pick one use case and the two or three systems it needs. Switch every tool to read-only, map the data that will flow, build behind a gateway with logging and run alongside manual work. Then review with leadership and decide whether to expand or stop. Not every use case needs MCP, since a plain API is sometimes simpler and easier to secure.
Why C9 Compares Differently From Hundreds of Other Developers
Australia has no shortage of software developers. What separates C9 is how the team is built and how work is handed over.
A blended hybrid inshore and offshore team. C9 combines local oversight and communication with a wider pool of engineering capacity, so you are not relying on a single individual.
Knowledge transfer built into delivery. Documentation and handover are planned from the start, so you keep the freedom to change suppliers.
Multiple resources, not one developer. Projects can draw on development, testing, design and data skills as one integrated team. C9's website states 18+ years in business and 350+ completed projects.
C9 can help scope and build custom APIs, integrations and MCP servers, with security considered from the design stage. No system can be guaranteed secure, so results depend on the design, testing and your own environment.
Staff Augmentation Options and Flexibility
If you would rather direct the work yourself than hand over a whole project, staff augmentation lets you add skilled people to your team. C9 offers more than a single software developer. You can bring in an integrated team, such as developers, testers, designers and data specialists working together.
How the team works
C9 does not use in-house local hiring in Australia. Team members are remote workers. You should not expect someone to arrive at your office for a 9-to-5 day. Collaboration happens through agreed tools and regular meetings.
Engagement options
| Option |
Best for |
Commitment |
| Minimum term of 3 to 6 months |
Building and securing an MCP server or integration layer |
Fixed minimum, then extend or scale |
| Monthly contract |
Short top-ups, urgent capacity or trials |
Flexible month to month |
| Project-based |
A clearly scoped deliverable |
Agreed scope and milestones |
Why a 3 to 6 month minimum is usually the better choice
- Onboarding takes time. New people must learn your systems, data and security rules before they are productive.
- Security needs continuity. Access models, logging and approvals depend on context, so the same people avoid repeated handovers and gaps.
- Knowledge stays with the project. Stable teams document and transfer knowledge more reliably, and permissions and testing rarely finish in a few weeks.
Monthly contracts remain useful for short, well-defined needs. For anything that must be built, secured and handed over, a minimum term is generally the safer fit.
Frequently Asked Questions
Is MCP safe to use in business?
It can be used safely, but safety depends on how it is built and governed. Common failures include weak authentication, excessive permissions, exposed servers and untrusted packages.
Does MCP security matter if we are not APRA-regulated?
Yes. The Privacy Act applies to many organisations, and from 10 December 2026 automated decision-making disclosure rules apply where the criteria are met.
What is staff augmentation?
It means adding external specialists to your team on an agreed basis, while you keep control of priorities and direction.
Will I get one developer or a team?
Either. C9 can provide an integrated team with complementary skills, not only a single developer.
Will someone work from our office?
No. C9 uses remote workers and does not hire locally in Australia for client placements. Expect regular online collaboration, not an office presence.
What is the minimum commitment?
Longer builds suit a minimum term of 3 to 6 months. Monthly contracts suit shorter needs.
Conclusion
MCP security comes down to plain questions. Who is the AI acting as? What can it do? Where does it live? What data moves? Can you see it, and can you stop it?
Ask them before the connection goes live, start with one read-only workflow, and be wary of fast, cheap builds that leave you with code nobody understands.
Talk to C9 About a Secure AI Connection
Planning an AI connection and want it reviewed or built with security in mind? C9 can help you scope one workflow, review your systems, permissions and data flows, and choose the team model that suits you, whether a 3 to 6 month engagement or a monthly arrangement.
Book a scoping conversation with C9
Sources and References
MCP security research and guidance
Australian context and regulation
Vibe coding and AI app builders
About C9
This article is general information, not legal, security or financial advice. Check current legislation and standards for your circumstances.
AI Transparency Notice
This article was produced with the assistance of artificial intelligence tools for research and content drafting. All content has been reviewed and approved by C9 prior to publication.