Researchers warn of protocol pivoting attacks exploiting trust gaps in AI agent communication standards

Independent researcher Syed Anas Mohiuddin demonstrated proof-of-concept attacks exploiting trust gaps in the Model Context Protocol (MCP), a standard for agent-to-agent communication within internal networks. The attacks, which Mohiuddin calls "protocol pivoting," allow malicious prompts to traverse from one agent to another, bypassing guardrails and enabling server-side request forgery (SSRF). Mohiuddin tested agents from Google, JP Morgan Chase, Weviate, Rapid7, the French government’s interministerial digital directorate, and a U.S. federal agency, finding vulnerabilities in each.

The technique exploits implicit trust between agents and lax guardrails in specialized agents, such as those for translation or data analysis. Because MCP servers store credentials for each agent and agents are designed to trust one another, an exploit that would typically be rejected by a large language model (LLM) can succeed when propagated through the agent chain. In many cases, well-crafted prompts targeting the right agent lead to unauthorized network requests, a hallmark of SSRF vulnerabilities.

Mohiuddin identified CVE-2026-97228 in Rapid7’s systems, rated 2.7 out of 10 in severity, which Rapid7 patched last month. The vulnerability affecting Google was more severe, rated 8 out of 10, and stemmed from an MCP toolbox for databases initializing its HTTP client without a CheckRedirect policy and failing to validate target IP addresses. A crafted path parameter could redirect the toolbox to an internal endpoint, sending requests on the attacker’s behalf. Google’s fix involved applying an allow-list of IP ranges and block lists, rejecting unsafe base URLs at startup.

The protocol pivoting technique works when an application or server uses MCP to assign a task to an agent, which then forwards malicious instructions to another agent using a different communication method, such as Google’s Agent-to-A2A protocol or the emerging Agent Network Protocol. Trust or authorization is often lost in translation, enabling multi-step attacks where adversaries gain initial access through one protocol and escalate to capabilities accessible via another.

Security researchers debate terminology, with some arguing the technique is a subclass of prompt injection. Markus Vervier of X41 D-Sec described it as "indirect prompt injection," noting that the malicious prompt can originate from one protocol and manifest when used over another, though this is not strictly required for such attacks to work. The core challenge, experts say, is the unexpected and hard-to-mitigate nature of these exploits in systems designed with implicit trust between components.

The widespread adoption of MCP and similar protocols—often before sufficient testing and hardening—has led organizations to abandon core security principles like zero trust. Under zero trust, networks are designed with the assumption that one or more nodes may be compromised, requiring authorization for sensitive transactions. The lack of such safeguards in agentic architectures creates opportunities for attackers to move laterally across systems, exploiting design assumptions that prioritize functionality over security.