Security researcher Syed Anas Mohiuddin has identified a vulnerability in AI agent communication protocols, specifically the Model Context Protocol (MCP). The flaw allows compromised agents to propagate malicious instructions across corporate networks by leveraging trust between interconnected systems.
The attack, dubbed protocol pivoting, enables agents to pass harmful commands as routine tasks. This can trigger Server-Side Request Forgery (SSRF), granting unauthorized access to internal network resources. Markus Vervier of X41 D-Sec classifies this as a form of prompt injection.
Vulnerabilities were demonstrated in systems linked to Google, JPMorgan Chase, Weaviate, Rapid7, the French interministerial digital services, and the US federal government. The Rapid7 flaw was rated 2.7 out of 10 and patched in September.
Google's MCP Toolbox for Databases had a more severe vulnerability, rated 8 out of 10, which allowed HTTP clients to follow redirects to internal IP addresses. Google resolved this by implementing allowlists and blocking insecure network destinations.
