A class of security vulnerabilities affecting the Model Context Protocol (MCP)—a standard used for communication between AI agents inside organizational networks—has been identified across multiple major organizations. Independent researcher Syed Anas Mohiuddin demonstrated proof-of-concept attacks targeting agents from Google, JP Morgan Chase, Weviate, Rapid7, the French government’s interministerial digital directorate, and the US federal government. These attacks exploit trust gaps between agents by injecting malicious prompts through one agent to another.
The vulnerability stems from the way MCP-connected agents operate. Many special-purpose agents lack sufficient safeguards against prompt injection attacks. Since MCP servers store credentials for each agent and agents are designed to trust other internal agents implicitly, malicious instructions that would normally be rejected by a language model can successfully execute. The attacks frequently result in server-side request forgery vulnerabilities, causing compromised servers to make unauthorized network requests on behalf of attackers.
Mohiuddin has termed this attack vector “protocol pivoting,” describing it as a multi-step exploitation where attackers gain initial access through one protocol, exploit trust assumptions between different communication methods, and escalate to capabilities only accessible through alternative protocols. For example, an attacker plants text in content that one agent reads and forwards to another agent as a delegated task, with the second agent executing the instruction because it trusts the source. The vulnerability in Rapid7’s network received a severity rating of 2.7 out of 10 and was subsequently fixed. Google’s MCP database toolbox vulnerability was rated as more severe at 8, stemming from improper HTTP client initialization and lack of IP address validation.
The prevalence of this vulnerability across unrelated organizations highlights broader security concerns. MCP has been rapidly adopted before undergoing sufficient security hardening, and many organizations have abandoned zero-trust security principles in their rush to deploy expansive agent architectures. Security researchers and industry observers note that the underlying bugs are not new—injection and server-side request forgery vulnerabilities have existed for decades—but the application to AI agent networks presents fresh attack pathways. Fixes typically involve implementing allowlists of IP ranges, blocklists, and validating URLs at startup rather than during initial requests.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI