Security researchers have identified a class of vulnerabilities in the Model Context Protocol (MCP), a standard used for communication between AI agents within internal networks. The attack method, demonstrated across five major organizations in the past five months, involves exploiting trust assumptions between connected agents to spread harmful instructions from one agent to another.
Independent researcher Syed Anas Mohiuddin tested agents from Google, JP Morgan Chase, Weviate, Rapid7, the French government’s interministerial digital directorate, and the US federal government. His proof-of-concept attacks revealed that specialized agents often lack sufficient security guardrails and are designed to trust other internal agents implicitly. This creates a pathway for attackers to inject malicious prompts into one agent, which then forwards them to downstream agents that execute the instructions without question.
The vulnerabilities typically result in server-side request forgery attacks, where compromised agents make unauthorized network requests on an attacker’s behalf. A particularly severe vulnerability in Google’s database MCP toolbox was rated 8 out of 10 in severity. It stemmed from the HTTP client failing to validate target IP addresses and lacking proper redirect policies, allowing attackers to craft parameters that redirect requests to internal endpoints. Google addressed the issue by implementing allow-lists and block-lists of IP ranges and validating URLs at startup.
Researcher Douglas McKee of Rapid7 characterized the attack pattern as particularly insidious because each component in the chain operates as designed, making detection difficult. The core security issues—injection and server-side request forgery—are longstanding problems, but their manifestation across multiple communication protocols represents a novel attack surface. The broad effectiveness of these exploits across disparate organizations suggests that MCP technology has been adopted rapidly without sufficient security hardening, representing a departure from zero-trust security principles that assume individual network nodes may be compromised.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI