Defenders must differentiate between sanctioned engineering automation and anomalous behavior. The primary indicator of potential risk is the introduction of a "first-seen" tool, connector, or resource access pattern by a user within the enterprise environment. Monitoring these transitions allows security operations teams to identify when an actor begins querying an internal resource they have not previously interacted with, which is a key indicator of internal reconnaissance or exfiltration.

Impact

The unauthorized use of MCP tools can lead to the exposure and exfiltration of sensitive corporate data stored in connected enterprise repositories. If an agent session is compromised or if an insider actor leverages these integrations, proprietary source code, internal communication logs, and sensitive customer or infrastructure metadata can be systematically pulled into an external AI session, potentially bypassing standard data loss prevention (DLP) controls.

Recommendation

Detection engineering teams should focus on identifying the introduction of new organizational/user/tool combinations.

• Implement monitoring for the 'app_mcp_call' event action within OpenAI ChatGPT Enterprise audit logs.
• Establish a baseline of approved MCP connectors and tool names; alert on any tool call that does not match an entry in the organization's approved inventory.
• Review session logs associated with a 'first-seen' tool call for indicators of prompt injection, retrieval of sensitive data, or unusual volumes of data being pulled from resource IDs.
• Treat sessions involving unapproved MCP connectors as potential data exposure incidents; initiate an immediate review of the session history to identify the extent of information retrieved.