Security researchers have identified a class of vulnerabilities affecting the Model Context Protocol, a standard used for communication between AI agents and applications within internal networks. In the past five months, at least five organizations—including Google, JP Morgan Chase, Weviate, Rapid7, and government agencies—have acknowledged exploits targeting these trust gaps.
The attack technique exploits what independent researcher Syed Anas Mohiuddin calls “protocol pivoting.” The method works by injecting malicious prompts into one agent, which then forwards the instructions to another agent that implicitly trusts the first. Many specialized agents lack sufficient guardrails to detect or block such instructions, and since MCP servers maintain stored credentials for each agent, the attack often succeeds where traditional safeguards might fail. The resulting exploits frequently lead to server-side request forgery vulnerabilities that allow unauthorized network requests.
A notable example involved Google’s MCP database toolbox, which was rated with a severity score of 8 out of 10. The vulnerability stemmed from improper HTTP client initialization and failure to validate target IP addresses, allowing attackers to craft path parameters that would redirect requests to internal endpoints. Google’s fix involved implementing allow-lists and block-lists of IP ranges and validating URLs at startup. Another vulnerability affecting Rapid7 was rated at 2.7 out of 10 and was subsequently patched.
Security experts emphasize that the underlying bugs are not new, citing injection attacks and server-side request forgery as long-standing security challenges. However, the vulnerability class highlights a broader concern: organizations have rapidly deployed MCP and agent-based architectures without sufficient security hardening or adherence to zero-trust principles. Researchers recommend treating any data passed from language models to tools as untrusted input, applying the same defensive strategies used against external threats for over two decades.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI