What happens when a protocol goes from idea to everywhere before security can catch up? Vandana Verma Sehgal, leader of the OWASP MCP Top 10, returns to explain why most organizations cannot say how many MCP servers are running on their developers' machines. She walks Chris and Robert through how MCP turns a chatbot into a new execution layer, how four lines of malicious code in a tiny server can slip past everyone, and why shadow MCP servers are shadow IT with direct access to action. The three debate whether we are missing the window to build AI security in from the start, why consent fatigue is undermining human in the loop, and where command execution really happens. Plus: why a secure MCP server should be boring, and why no MCP server deserves trust on day one.
This episode is sponsored by Security Compass. Make modern software development secure, consistent, and provable.
About Security Compass
AI writes code faster than anyone reviews the design. Threats do not wait for an annual assessment. Security Compass models threats continuously and turns them into requirements developers act on, not a report read after ship.
→ Learn more about securing the AI-DLC with Security Compass
This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it.
About Corgea
Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely.
→ Learn more about Corgea
Connect with Vandana Verma Sehgal:
→ Vandana Verma Sehgal on LinkedIn
Mentioned in this episode:
→ OWASP MCP Top 10
→ OWASP MCP Top 10 on GitHub
→ OWASP Top 10 for Large Language Model Applications
→ OWASP Top 10 for Agentic Applications for 2026
→ OWASP Agentic Skills Top 10
→ Model Context Protocol
→ EU AI Act (Regulation (EU) 2024/1689)
→ Singapore IMDA: Model AI Governance Framework for Agentic AI
Follow the Application Security Podcast:
➜ Home: appsecpodcast.com
➜ X: @AppSecPodcast
➜ LinkedIn: The Application Security Podcast
➜ YouTube: @ApplicationSecurityPodcast
➜ Instagram: @appsecpodcast
➜ Facebook: Application Security Podcast
Chapters:
00:00:00 - Cold open: with great power comes great responsibility
00:00:20 - Meet Vandana Verma Sehgal
00:00:34 - Welcome and what gets Vandana away from screens
00:03:05 - What is MCP, and why should AppSec teams care now?
00:06:56 - MCP moved faster than any protocol before it
00:10:30 - Are we missing the window to secure AI?
00:12:31 - Harnesses, an AI security manifesto, and the EU AI Act
00:17:50 - Why the world needed an OWASP MCP Top 10
00:21:02 - Where command execution really happens
00:23:57 - How the list was built: community feedback and CVE data
00:26:46 - MCP09: shadow MCP servers
00:29:39 - If you could fix only one: scope creep
00:30:48 - Authentication, authorization, and delegated authority
00:35:24 - Consent fatigue and the human in the loop
00:37:04 - What a secure MCP server looks like: boring by design
00:41:27 - How AppSec teams should engage developers building MCP
00:44:46 - How to contribute to the OWASP MCP Top 10
00:45:41 - Key takeaway: never trust an MCP server on day one
