Quick Summary
Five recent incidents show the same pattern: AI capability is outpacing governance. None was caused by malicious AI — each traces back to permissions, visibility, and oversight gaps that trust assessments and governance reviews are designed to close.
Executive summary
AI adoption is accelerating, but so are governance, security, and operational risks. This report highlights five recent incidents that demonstrate why organizations need stronger oversight and trust-assessment frameworks. The goal is not alarm — it is pattern recognition: each incident points to a control that, if in place, would have meaningfully reduced the risk.
Get the full June 2026 report
A share-ready PDF of all five incidents, governance lessons, and the action checklist.
Incident #01 — AgentJacking: A New Attack Technique Targets MCP-Connected AI Agents
What happened. Security researchers described a technique they called “Agentjacking,” in which an attacker plants malicious instructions inside data an AI coding agent later reads through an MCP server — for example, a crafted error event in a monitoring tool. When a developer asks the agent to act on that data, reports indicate the agent could not reliably distinguish the injected content from legitimate input and executed attacker-influenced actions with the developer’s own privileges.
Why it matters. Because every step in the chain is technically authorized, the activity can pass straight through traditional controls like firewalls, EDR, and IAM. The trust boundary is not the network — it is the content the agent reads and acts on.
Governance lesson. MCP-connected agents need explicit trust boundaries around untrusted content, plus runtime monitoring of the actions they take. Treat anything an agent ingests as potentially adversarial input, not trusted instruction.
Every step is technically authorized — so the chain bypasses firewalls, EDR, and IAM.
Key takeaway: Trust boundaries and runtime monitoring matter.
Incident #02 — Frontier-Model Safety Concerns Draw Government Attention
What happened. Frontier-model safety moved squarely into the policy arena. A leading AI lab published a detailed framework calling for mandatory third-party testing of advanced models across cybersecurity, biosecurity, and loss-of-control risks, while U.S. authorities issued export-control directions that restricted access to certain frontier models on national-security grounds.
Why it matters. It is a clear signal that the most capable models are now treated as systems with national-security implications — and that external oversight, not just internal review, is becoming part of the landscape organizations build on.
Governance lesson. AI capabilities often evolve faster than the governance frameworks meant to contain them. Enterprises should track model provenance, assume the regulatory baseline will rise, and design controls that do not depend on any single model remaining available.
AI Capability
Frontier capability advancing rapidly, month over month.
Governance Controls
Oversight frameworks lagging behind capability.
The gap between capability and governance is where most risk accumulates.
Key takeaway: AI capabilities often evolve faster than governance frameworks.
Incident #03 — An AI Coding Agent Reportedly Deletes a Production Database
What happened. Multiple public accounts in 2025 and 2026 described AI coding agents deleting production data using valid credentials and approved APIs. In one widely reported case, an agent removed a company’s production database — and backups within the same blast radius — in seconds after acting on a misread of its environment. The credentials were legitimate; the actions were permitted.
Why it matters. The failure was not a malicious model. It was access control: the agent could reach production and its backups at all, with no approval gate between intent and irreversible action.
Governance lesson. Human-approval workflows and least-privilege permissions remain critical. Separate staging from production, keep backups outside the agent’s reach, and require explicit approval for destructive operations.
SStaging
- Read & write
- Disposable data
- Safe to fail
Production
- Approval required
- Backups isolated
- Destructive ops gated
Key takeaway: Human approval workflows and permission controls remain critical.
Incident #04 — Researchers Find Large Numbers of Publicly Exposed MCP Servers
What happened. Internet-wide scans through 2026 catalogued tens of thousands of publicly reachable MCP servers, with a large share running with no authentication at all and many relying on static, long-lived API keys rather than modern OAuth flows. The exposed surface grew month over month as adoption accelerated.
Why it matters. An unauthenticated MCP server is an open door to whatever it connects to. The data shows organizations are deploying MCP faster than they are securing and governing it.
Governance lesson. Maintain an inventory of MCP servers, require authentication and scoped permissions by default, and never expose a server to the public internet without a clear, reviewed reason.
MCP Exposure Snapshot
Directional figures synthesized from 2026 internet-scan research; exact counts grew month over month.
Key takeaway: Organizations are adopting MCP faster than they are governing it.
Incident #05 — Multiple MCP Vulnerabilities Highlight Emerging Ecosystem Risks
What happened. Researchers disclosed dozens of MCP-related vulnerabilities across the ecosystem, spanning authentication bypasses, broken authorization, remote code execution, and information disclosure. Several carried critical severity scores. Reviewers noted the root causes were rarely exotic — missing input validation, absent authentication, and blind trust in tool descriptions.
Why it matters. MCP is a young, fast-growing ecosystem, and much of the risk traces back to fundamentals rather than novel exploits. That makes it both serious and addressable through disciplined security practice.
Governance lesson. MCP servers require ongoing security review — dependency scanning, authentication and authorization checks, and validation of tool inputs — not a one-time approval at adoption.
Authentication
Missing or bypassable auth on exposed endpoints.
Authorization
Broken scope enforcement and privilege boundaries.
Remote Code Execution
Command and code injection through unvalidated input.
Information Disclosure
Leakage of secrets, tokens, and internal data.
Key takeaway: MCP ecosystems require ongoing security review.
Common themes across all incidents
Read together, the five incidents are not five different problems. The same issues appear again and again: excessive permissions, poor governance, a lack of visibility, missing audit controls, weak authentication, and limited human oversight. Trace each to its root, and they converge on one thing.
Insufficient
Trust & Governance
Different incidents, one shared root: gaps in trust, permissions, and oversight — not malicious AI.
What organizations should do now
The encouraging news is that the controls are well understood. None of these requires exotic technology — they require deciding, on the record, what your AI agents and MCP servers may do, and verifying it. Start here.
Inventory AI agents
Know every agent operating against your systems.
Review MCP integrations
Map each MCP server and what it connects to.
Review permissions
Tighten scopes to least privilege; revoke unused access.
Enable audit logging
Record every action so it can be reviewed later.
Establish governance controls
Require review and approval before connection.
Perform trust assessments
Evaluate servers and agents against a clear framework.
Conduct risk reviews
Reassess on a cadence, not just at adoption.
The emerging need for AI trust assessments
It is worth restating the through-line: most of these incidents were not caused by malicious AI. They were caused by insufficient governance, excessive permissions, poor controls, and weak visibility. That distinction matters, because it tells you where to invest. You do not primarily need to defend against a hostile model — you need to understand and constrain what the systems you have already deployed are allowed to do.
This is what creates the growing need for structured trust assessments: a repeatable way to evaluate an agent or MCP server’s permissions, security, governance, and transparency before it connects, and to reassess it as it changes. The same review that would have flagged an over-permissioned database connection or an unauthenticated MCP server is the review that scales as your AI footprint grows.
Looking ahead
This is the first in a planned series. Metinc intends to publish a monthly AI Trust & Governance Incident Report so teams can track how the landscape is moving without combing through scattered disclosures themselves.
Each month, Metinc plans to track the incidents and patterns shaping AI trust and governance.
Metinc is exploring methodologies that help organizations better understand trust, governance, transparency, and operational risk across AI agents and MCP ecosystems — so adopting new capabilities does not mean losing visibility or control.