SASE Sees HTTPS to LLM – Not the Intent
Traditional SASE looks at the HTTPS session to the LLM – not the intent. As soon as AI agents invoke MCP tools, proxies and URL filters react too late: the moment of intent occurs before the network inspection point.
Key Takeaways
- Package view ≠ Intent view. A valid TLS tunnel to an allowed LLM endpoint says nothing about tool calls and data extraction.
- MCP multiplies the attack surface. Agents discover and invoke tools – often beyond the old DLP assumptions “User pastes in Browser”.
- Control needs two channels. Model-Proxy and Tool-Gateway (Policy on the MCP path) must correlate intent and action.
Related: Cursor launches git.exe from the repo root · What is Zero Trust? Definition, Principles and Components · OWASP Agentic AI Top 10: When AI agents become the largest attack surface
The Architecture Gap in a Sentence
Secure Access Service Edge (SASE) and Secure Web Gateways were designed to classify, decrypt, and enforce URL, malware, and Data Loss Prevention (DLP) rules on user traffic. In agentic workflows, this assumption breaks. The proxy sees an allowed, encrypted connection to a Large Language Model (LLM) provider. It does not realize that an agent, using Model Context Protocol (MCP), binds internal repositories, tickets, or knowledge bases as tools and extracts content.
Articles in July 2026 (including The Hacker News on the SASE‑AI Blind Spot) highlight this as an intent gap: the decision and tool call occur before the package reaches classic network inspection – or they run through channels that the edge proxy never sees (local agents, IDE plugins, private MCP servers).
Definition · MCP
Model Context Protocol is an open protocol that enables Artificial Intelligence (AI) agents to discover and invoke tools and data sources. It separates the model channel from tool execution – and thus also the control surfaces.
Why Legacy DLP Approaches No Longer Work
The classic model: employees open a browser, paste text, and HTTPS leaves the company. Controls: CASB, SWG, Browser Isolation, Prompt-DLP. Endpoint agents and IDE-native agents bypass parts of this chain. They operate on the host, keep context locally, and communicate with MCP servers that are either on-premises or in SaaS.
Unmanaged MCP servers multiply the risk. Market estimates speak of tens of thousands of public MCP servers – without comprehensive security inventories, authentication standards, or audit trails. Those who only “block ChatGPT domains” miss the entire agent pathway.
What security teams need to rebuild
First, inventory: Which agents are running (IDE, desktop, server-side)? Which MCP servers are allowed? Which identities and secrets do they use? Second, policy on the tool channel: Allowlists for tools, parameter sanitizing, data classification before the call, logging every tool access with user/agent/context.
Third, correlation: Model proxy (prompt/response) and MCP gateway (tool execution) must be readable together. Otherwise, the intent stays in the prompt and the action stays isolated in the tool log – exactly the gap exploited in current agent exfiltration scenarios.
| Control plane | What it sees | What it often misses |
|---|---|---|
| SASE / SWG | Target domain, TLS metadata, optionally payload after decrypt | MCP tool intent, local agent calls |
| CASB / SaaS-DLP | Activity of known SaaS apps | Private MCP servers, IDE agents |
| MCP gateway | Tool name, args, identity, result | Without model correlation: prompt context |
Source: SecurityToday’s classification based on industry trends July 2026
Pragmatic Start Without a Big Bang
No company needs tomorrow the “AI-Security-Platform of everything”. A robust start: agent inventory in engineering and business units, default-deny for unknown MCP servers, secrets not hard-coded in agent contexts, and a gateway pilot for the most productive tool paths (code repos, ticket systems, internal wikis).
Initial Checks
- ✓Agent and MCP inventory with owner and data classes
- ✓Allowlist for MCP servers and tools in production
- ✓Logging: who, which tool, which resource, which output scope
- ✓Extend SASE rules to agent endpoints
SASE remains relevant for the network and SaaS edge. It is simply no longer the sole truth about AI-driven work. Whoever does not control intent and tool execution does not control the actual data flow.
Frequently Asked Questions
Every question is locked. A tap unlocks the answer.
Is TLS inspection sufficient for AI agents in SASE?
Only partially. It can see domains and, where applicable, payloads. It inadequately covers MCP-Tool-Intent and local agent execution.
What is the difference between Model-Proxy and MCP-Gateway?
The Model-Proxy controls Prompt/Response to the LLM. The MCP-Gateway controls tool calls and data sources. Both channels must be correlated.
Are public MCP servers categorically prohibited a sensible approach?
Default-Deny set to yes, plus an allowlist for vetted servers. A blanket “everything open” approach does not scale in regulated environments.
Does this only concern developer IDEs?
No. Server-side Agents, Automations and departmental tools use the same patterns – often with broader data rights.
What is the fastest risk-reducing step?
Inventory of productive Agents plus blocking of unknown MCP servers and Secrets hygiene in Agent configurations.
Editor’s Picks
Editor’s PickCursor Launches git.exe from Repository Root on WindowsEditor’s PickAn npm package that stole the private keysEditor’s PickWhat Is Zero Trust? Definition, Principles, and Components
More from the MBF Media Network
cloudmagazinCloudFront 5xx: What VPC Origins Teams Need to CheckDigital ChiefsHow to Stifle Open Source Without Banning It
