AI agents and Model Context Protocol (MCP) servers offer new opportunities for law firms and IP management—but they also introduce significant cybersecurity risks.
Artificial intelligence is evolving beyond answering questions and generating text. Today, AI agents can search databases, retrieve documents, process emails, call APIs, and execute actions across enterprise systems. The Model Context Protocol (MCP) provides a standardized way for AI models to interact with external tools and applications.
For law firms and intellectual property (IP) departments, these capabilities can streamline patent research, document analysis, deadline tracking, and administrative workflows. However, once AI can take action rather than simply generate text, security risks change fundamentally. An incorrect answer may become an unauthorized action with real-world consequences.
What Recent AI Security Incidents Teach Us
In May 2026, AI security company Irregular tested the cybersecurity capabilities of advanced AI models in simulated corporate environments. According to the source article, Google's Gemini inadvertently gained access to the public internet during a test and interacted with systems belonging to three real companies.
The incident highlighted a critical security weakness: insufficient isolation between a simulated environment and real-world systems.
The lesson for businesses is clear. The primary concern is not necessarily that an AI model develops malicious intentions. It is that an AI agent may execute a task using technical permissions that exceed its intended scope.
This distinction is particularly important when AI agents connect to business applications through MCP servers.
Why AI Agents Create New Cybersecurity Risks
Traditional enterprise software generally follows predefined rules. AI agents, by contrast, dynamically select tools and actions based on their objectives, context, and available capabilities.
An MCP server might expose functions such as searching case files, downloading documents, creating notes, sending emails, deleting deadlines, or submitting applications.
If an agent has excessive permissions, a single mistake can trigger unauthorized data access, disclosure of confidential information, or unintended changes to business records.
One major threat is indirect prompt injection. A seemingly ordinary PDF, email, or webpage may contain malicious instructions designed to influence an AI agent. If the agent can access confidential documents, export files, and communicate externally, manipulated content could initiate a damaging sequence of actions.
Instructions such as “never access another client's confidential files” are not sufficient security controls. Actual access restrictions must be enforced by the underlying software.
The Principle of “Assume Agent Compromise”
Organizations should design AI systems around the principle of Assume Agent Compromise. Instead of assuming that an AI model will always behave correctly, security architecture should anticipate mistakes, misunderstood instructions, prompt injection, and unexpected tool usage.
The key question is:
What is the maximum damage an AI agent could cause if it made the wrong decision?
The answer depends on how its access to data, networks, credentials, and executable functions is restricted.
10 Best Practices for Secure AI and MCP Deployments
Start with read-only access. Separate document search and analysis from functions that modify records, send emails, or delete information.
Avoid unrestricted service accounts. Whenever possible, execute requests within the authenticated user's security context. Check permissions on the server for every tool call.
Enforce authorization outside the AI model. Application-level access controls, role checks, and client separation must never depend solely on system prompts.
Require human approval for critical actions. Confirm actions such as sending external communications, exporting large datasets, changing deadlines, deleting documents, or submitting official applications.
Restrict internet access. Allow connections only to explicitly approved services and APIs required for the task.
Keep credentials separate from the model. API keys, passwords, database credentials, and OAuth tokens should remain in secure server-side systems. Use narrowly scoped, short-lived credentials where possible.
Treat external content as untrusted data. Emails, PDFs, websites, attachments, and tool outputs may contain malicious instructions and must not automatically be treated as authorized commands.
Enforce client separation before data reaches the AI. Search results, document retrieval, and API requests must respect existing permissions and confidentiality barriers.
Log and monitor agent activity. Record relevant users, sessions, tools, actions, affected records, timestamps, and outcomes. Detect suspicious patterns such as mass exports or unusual access volumes.
Approve and manage MCP servers centrally. Prevent unauthorized extensions from entering production environments and review approved tools for changes and vulnerabilities.
Secure AI Integration for IP Management Systems
For IP management systems (IPMS), one of the most important architectural decisions is how an AI agent accesses confidential business data.
Giving an agent direct access to a database or document repository can create a parallel access layer that bypasses existing application permissions and business rules.
A safer approach is to connect the AI through the application's established interfaces, such as the GeneseConnect REST API offered by Genese.
With this architecture, an MCP server acts as an intermediary between the AI agent and the IP management system. Requests pass through the application's existing authentication, authorization, and business logic rather than accessing the database directly.
The architecture follows this pattern:
User → AI Agent → MCP Server → GeneseConnect REST API → Genese Business Logic and Access Controls → Data
For example, when a user asks an AI agent to summarize current patent files for a client, the agent can initiate a search through MCP. GeneseConnect then applies the user's existing permissions and returns only the records that the user is authorized to access.
Even if the AI attempts to retrieve additional files because of a misunderstanding or malicious prompt injection, the application should deny unauthorized requests.
This approach preserves the IP management system as the authoritative source for access control.
Apply Different Security Levels to Different Actions
Not every operation carries the same level of risk. Searching for a case reference is fundamentally different from exporting an entire file archive or submitting a legally significant application.
A secure integration should distinguish between:
- Read operations: Searching files, viewing case information, and retrieving document lists.
- Internal changes: Creating notes or updating permitted records.
- External actions: Sending emails, exporting documents, or transmitting data to third parties.
- Critical actions: Deleting deadlines, submitting IP applications, or sending legally binding communications.
The greater the potential impact, the stronger the required safeguards should be. These may include additional authentication, explicit human approval, detailed audit logs, and technical restrictions.
The governing principle is straightforward: user permissions define what is allowed, the API defines which functions are available, the MCP server limits which tools the AI can use, and human approval protects particularly sensitive actions.
Conclusion: Control the AI Agent's Capabilities, Not Just Its Instructions
AI agents and MCP integrations can deliver substantial productivity benefits to law firms and IP professionals. Avoiding the technology entirely is not necessarily the answer. The priority should be to establish clear, enforceable security boundaries.
An AI agent should be treated as a powerful software component—not as a trusted user with unrestricted access.
For IP management, integrating AI through a controlled interface such as the GeneseConnect REST API helps preserve existing permissions and business rules while enabling AI-assisted workflows.
Access controls, client confidentiality, credential management, network restrictions, activity monitoring, and human approvals must be enforced by the surrounding technical architecture.
The most important security principle is this: AI may decide how to complete an authorized task, but it must never decide what it is authorized to do.
As AI agents become more autonomous, secure MCP integrations will depend less on trusting the model and more on limiting what it can do when something goes wrong.
Top comments (0)