MCP and AI agents — who reads your ad account

Jakub Pytlik | March 20, 2026 | 9 min read

What MCP is (in plain language)

MCP — Model Context Protocol — is simply a shared language that lets AI talk to your tools. When you want ChatGPT or Claude to look into your Google Ads account — check results, suggest a change, pull data — it needs some way to connect to that account. MCP is that way. The standard was announced in late 2024 by Anthropic (the makers of Claude), and the big players picked it up fast.

Google has released its own plug-in for it — for now, read-only. That means AI can read your account stats but can't change budgets, campaigns or bids. That's good news. But "for now" is the key phrase here — full access, with the right to make changes, is already on Google's roadmap.

The short version: the industry is building a layer in which your ad account becomes "just another tool" that AI can operate on its own. The question is no longer "will this happen" — it's "when, and on what terms, will you agree to it".

Who's already using it and how fast it's growing

Every major player has already lined up behind MCP — Amazon, Microsoft, Google, OpenAI. So this isn't a curiosity for developers; it's the foundation for a new generation of marketing tools. These days almost every popular marketing platform is growing its own "AI agent" — this isn't a distant future, it's happening right now.

In practice it looks like this: sooner or later your marketer, agency or some tool vendor will tell you "let's connect an AI agent to the account — it'll analyze the data, suggest optimizations, maybe even make changes itself". The question isn't whether someone will propose it. It's: on what terms will you say yes.

5 main risks

1. Access-key theft

So that an AI agent can talk to your account without logging in every time, it gets an access key — a kind of pass issued to the app. That key has to live somewhere: in the tool's memory, in a config file, sometimes in a cache. Each of those is a potential leak. And if someone takes over that pass, they immediately get everything you connected to it — Google Ads, Analytics, Merchant Center, your customer database, sometimes even email and chat.

2. The hidden-instruction attack

The attacker hides a command inside data the agent reads as part of its normal job — a web address, an email, a document, a file. The agent treats that hidden instruction as a normal task and carries it out: steals data, changes campaigns, hands over a password. Without a single click from you. The scarier part is that the instruction can be planted by an outsider — all it takes is for your agent to process that file or message. Ordinary antivirus or spam filters won't catch it, because everything happens "inside" the agent's normal work with data.

3. A fake server posing as a real tool

The attacker stands up their own server that poses as a known tool ("a better Google Ads analyzer"). Your agent connects to it in good faith, and the server quietly siphons off data or swaps the answers. The industry still has no good way to verify "who's who" in this new world — in 2026 it's still a bit of a Wild West.

4. Abandoned, unvetted integrations

Every new tool plugged into the agent is another door to your data — and another door someone can come through. Typical scenario: you install something your agency recommended, it works, you stop thinking about it. A year later the maker stops shipping patches, a security hole opens up — and nobody notices until something goes wrong.

5. Permissions that are too broad

Most integrations ask straight away for full admin access — "because it's easier that way". The principle "grant only as much access as is truly needed" is routinely ignored. The result: a tool that was only meant to read reports can, if it's breached, change budgets, swap out conversions, pause ads. It's easier to click "administrator" than to set up read-only access — and that's exactly why the potential damage is so large.

What has already happened

These aren't theoretical scare stories. Each of the cases below happened in the last year or so — I've kept the facts and cut only the jargon.

A leak that hit more than 700 companies at once

In the summer of 2025, attackers stole access keys from one popular marketing-automation platform — the kind thousands of companies rely on — plugged into a customer-management system. Nothing exotic: a routine "third-party tool ↔ customer database" integration, the kind plenty of agencies run. The result: in a single move they accessed the data of more than 700 companies using that integration. The lesson is simple: if your vendor falls over, you fall with them. Your security is only as strong as the weakest link in the chain of connected tools.

Data theft without a single click

There's a whole class of attacks where all it takes is for your agent to read a doctored email, file or link. The instruction hidden inside tells it to quietly send your data to the attacker — you click nothing and suspect nothing. Classic defenses (email filters, SMS codes, antivirus) don't see it, because as far as they're concerned the agent is just "doing its job". It's a real risk anywhere AI reads your inbox or documents on its own.

Impersonating a trusted platform

In early 2026, a well-known cloud-security firm showed how to turn a legitimate, well-known platform from a major provider into a tool for phishing access. The attack bypasses even two-step login, because it runs on the trusted company's own infrastructure — everything looks genuine. For now it's a demonstration under research conditions, not a mass campaign, but the technique is real and it works.

On top of that, one thing should give you pause: in the spring of 2026 the very creator of the MCP standard refused to patch a hole in its own software that lets someone take over another server — calling it "expected behavior". In practice that means tools built on this standard inherit that hole unless they protect themselves.

7 questions before you say yes

Before you connect an AI agent to your Google Ads account (or to anything valuable), ask the company doing it seven questions. The answers will tell you more than the whole sales pitch.

If even 2 of these don't get a concrete answer — don't connect. This isn't paranoia — it's exactly the caution you've long expected from a bank when you hand it your money.

Should you let an agent onto your account at all

A few questions I ask myself together with the client before we connect anything:

1. Do I even need an agent on the account? Maybe it's enough to export the data to a file and paste it into ChatGPT for analysis — with no live connection? If "yes, that's enough" — then it's enough.
2. What access exactly? Read-only, for a report — fine. The right to change budgets — stop. The right to change ads — only conditionally, and on a test account first.
3. Do I have a way out? If the agent hangs or starts doing strange things — how do I switch it off in 30 seconds? How do I undo what it's already done?
4. Do I trust this specific company? I don't trust "AI agents" as a concept. I trust (or don't) a specific company — its team, its certifications, whether it has already messed something up before.

My advice: 9 out of 10 businesses will be perfectly fine without a connected agent. Exporting the data and analyzing it in ChatGPT — without connecting the account — handles most needs and doesn't expose you to losing your access keys. For the remaining one in ten, there are still the 7 questions in the table above. No compromises.

About the sources: Article based on Hacker News — the MCP design flaw at Anthropic, Practical DevSecOps — MCP Security Guide 2026, Checkmarx Zero — 11 MCP risks, Bessemer — Securing AI agents 2026, Google Cloud — MCP support announcement, BlackFog — 10 data exfil risks, Kitecyber — AI agent security 2026 + observations from JP Ads client accounts. Numbers from my practice are labeled "from my experience".