Researcher Syed Anas Mohiuddin identified vulnerabilities in AI agents from five organizations, including Google, JP Morgan Chase, Weviate, Rapid7, and government entities. The flaws exploit the Model Context Protocol (MCP), which facilitates communication between agents within internal networks.
The attacks, dubbed protocol pivoting, involve injecting malicious instructions that one agent passes to another. Because agents are designed to trust internal counterparts, they execute these commands without sufficient validation, often leading to server-side request forgery.
Rapid7 addressed a vulnerability, tracked as CVE-2026-97228, which received a severity rating of 2.7 out of 10. Google resolved a more critical issue, rated 8 out of 10, which stemmed from an MCP database toolbox that failed to validate IP addresses and handle redirects.
Google implemented a fix by introducing an allow-list for IP ranges and block lists to prevent unauthorized network requests. The researcher noted that many MCP servers currently lack the necessary guardrails to verify delegated tasks, effectively abandoning zero-trust principles.
