AI Agent Has Root Access (and That's a Problem)

I connected a Postgres MCP to one of our bots. Wanted read access. The server also exposed DELETE, execute arbitrary SQL, and DROP TABLE.

Checked GitHub MCP — added for code reading. Also had delete_repository. Slack MCP — wanted search. Got remove_user and delete_channel.

There's no way to say "give the agent query but not drop_table." I checked Claude, Cursor, ChatGPT — all-or-nothing everywhere.

The numbers are bad: 1,808 MCP servers scanned — 66% had security findings. 30 CVEs in 60 days. 76 published skills contained malware. 5 of top 7 most-downloaded skills were malware.

We're giving agents system-level access without a permission model. This feels like early cloud days before IAM.

We built per-tool permissions into our gateway at Aerostack — each tool gets a toggle, destructive ops blocked by default, enforced at the proxy layer.

Full writeup: https://aerostack.dev/blog/your-ai-agent-has-root-access

Curious how others are handling MCP security today.