Security researchers have identified a significant vulnerability in the Model Context Protocol (MCP), a standard used for communication between AI applications and agents within internal networks. The flaw allows attackers to exploit trust gaps between agents, enabling the spread of malicious prompts that can lead to data exfiltration and unauthorized server actions.
The issue affects multiple major organizations, including Google, JP Morgan Chase, Rapid7, and government agencies in France and the United States. Independent researcher Syed Anas Mohiuddin demonstrated that the vulnerability, which he terms “protocol pivoting,” works by targeting specific agents rather than the large language model (LLM) itself. Once an agent is compromised, it passes harmful instructions to other agents that explicitly trust the source, bypassing standard security guardrails.
Google and Rapid7 Vulnerabilities
Google disclosed a vulnerability in its MCP toolbox for databases, rated with a severity score of 8 out of 10. The flaw stemmed from the HTTP client initialization lacking a CheckRedirect policy and failing to validate target IP addresses. This allowed crafted path parameters to redirect requests to internal endpoints, effectively enabling server-side request forgery (SSRF). Google addressed the issue by implementing an allow-list of IP ranges and block lists, rejecting unsafe base URLs at startup.
Rapid7 also acknowledged a vulnerability in its network, assigned CVE-2026-97228. Although rated at a lower severity of 2.7, the flaw demonstrated the broader risk of the protocol. Rapid7 fixed the issue last month. Douglas McKee, director of vulnerability intelligence at Rapid7, noted that the attack chain relies on each protocol checking its own front door while ignoring the hallway between them.
Trust Gaps in Agentic Networks
The core of the problem lies in the design of agentic architectures. Many special-purpose agents lack the robust guardrails found in general-purpose LLMs. Because MCP servers store credentials for each agent, and agents are built to trust every other internal agent, an exploit that would be rejected by an LLM can succeed when passed between agents.
Mohiuddin described the technique as a multi-step attack where an adversary gains initial access through one protocol, exploits trust assumptions between protocols, and escalates to capabilities accessible only via a different protocol. This often involves delegating tasks through Google’s Agent-to-Agent (A2A) protocol or emerging standards like the Agent Network Protocol.
Markus Vervier, a researcher at X41 D-Sec, argued that the term “indirect prompt injection” is more accurate. He stated that the fact the malicious prompt comes from a different protocol is unexpected but not strictly required for such attacks to work. The vulnerability highlights a departure from zero trust principles, where networks assume nodes may be infected and require authorization for sensitive transactions.
McKee emphasized that any data passed from an LLM to a tool should be treated as input from a stranger on the internet. The underlying bugs, such as injection and SSRF, are well-known, but the fixes have not kept pace with the rapid adoption of agentic systems. Naming the attack class is a critical step for defenders and standards bodies to design appropriate mitigations.
Source: Ars Technica
