Security researcher Syed Anas Mohiuddin has identified a fundamental vulnerability in AI agents stemming from their default mutual trust. This flaw allows attackers to compromise a single agent and propagate malicious instructions throughout an entire network of interconnected AI systems.
The vulnerability exploits the Model Context Protocol (MCP), which facilitates communication between AI agents. Because the protocol prioritizes autonomy, it lacks sufficient cross-agent verification, enabling attackers to bypass security measures that would typically block malicious prompts at the model level.
Five organizations, including Google, have acknowledged vulnerabilities related to this issue over the past five months. In Google's case, a flaw in an MCP database tool allowed unauthorized network requests, resulting in a security rating of 8 out of 10. A separate vulnerability at Rapid7, tracked as CVE-2026-97228, was rated 2.7 out of 10.
The attack method, termed 'protocol pivoting,' occurs when an agent receives a task via MCP and forwards malicious instructions to other agents using different communication standards, such as Google's Agent-to-Agent protocol. During this transition, authorization checks are often lost, granting attackers unauthorized access to internal network functions.
Experts warn that developers are currently neglecting zero-trust principles when deploying AI infrastructure. To mitigate these risks, organizations are advised to implement strict authorization requirements for all critical operations performed between network nodes, as current implementations of MCP lack adequate security testing.
