Security vulnerabilities discovered in the Model Context Protocol (MCP), a standard used for communication between AI applications and agents within internal networks, are creating new attack pathways for malicious actors. Independent researcher Syed Anas Mohiuddin documented proof-of-concept exploits affecting organizations including Google, JP Morgan Chase, Weviate, Rapid7, the French government’s interministerial digital directorate, and U.S. federal agencies.
The attacks exploit a specific type of prompt injection that targets individual agents rather than large language models directly. Because many specialized agents lack robust guardrails and are designed to trust other internal agents implicitly, malicious instructions can propagate through the network unchecked. When an initial agent receives harmful prompts, it forwards them to subsequent agents in the chain, which execute the instructions assuming they come from a trusted source. MCP servers store credentials for each agent, amplifying the potential damage when compromised.
Mohiuddin has termed this attack methodology “protocol pivoting,” describing it as a multi-step process where attackers gain access through one protocol and exploit trust assumptions between different communication standards, such as MCP and Google’s Agent-to-Agent protocol. A vulnerability in Google’s MCP database toolbox received a severity rating of 8 out of 10, stemming from improper HTTP client configuration that failed to validate target IP addresses or implement proper redirect policies. A separate vulnerability in Rapid7’s network carried a lower severity rating of 2.7 out of 10 before being patched.
Experts attribute the widespread vulnerability to organizations’ rapid deployment of AI agent architectures without sufficient security hardening. The rush to implement agentic systems has led many organizations to abandon the zero-trust security principle, which assumes nodes may be compromised and requires authorization before sensitive transactions occur. Researchers and security officials emphasize that the underlying bugs—injection attacks and server-side request forgery—are longstanding problems, but the distributed nature of agent networks requires new defensive strategies to address them effectively.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI