A pattern of security vulnerabilities has emerged across multiple organizations using AI agents that communicate through the Model Context Protocol (MCP). Independent researcher Syed Anas Mohiuddin identified exploits affecting Google, JP Morgan Chase, Weviate, Rapid7, the French government’s interministerial digital directorate, and the US federal government. These vulnerabilities stem from trust gaps in how agents relay instructions to one another through MCP and related protocols.
The attacks represent a specialized form of prompt injection targeting individual agents rather than large language models directly. When malicious instructions are planted through one agent, they are often passed along to other internal agents without adequate safeguards. Since agents are typically designed to trust other internal agents implicitly, the harmful directions are executed. The underlying issue is that many special-purpose agents lack sufficient guardrails, and MCP servers store credentials accessible to agents throughout the network.
The exploitation technique can result in server-side request forgery vulnerabilities that enable unauthorized network requests. Rapid7’s vulnerability was assigned a severity rating of 2.7 out of 10 and was patched during recent months. Google’s MCP toolbox for databases carried a higher severity rating of 8, resulting from improper HTTP client initialization and insufficient IP address validation. The fix required implementing allow-lists of IP ranges and block lists while rejecting unsafe base URLs at startup.
Researcher Syed Anas Mohiuddin termed this attack class “protocol pivoting,” describing it as a multi-step process where an adversary exploits trust assumptions between different communication protocols to escalate capabilities. While some security experts debate the terminology, noting similarities to existing indirect prompt injection techniques, the consistent appearance of these vulnerabilities across unrelated organizations suggests MCP deployment has outpaced security hardening. The situation reflects broader concerns about organizations adopting expansive AI agent architectures while abandoning zero-trust security principles that assume potential compromise at any network node.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI