The adoption of AI agents in millions of organizations is creating new opportunities for attackers to make them take malicious actions, such as exfiltrating database contents and sensitive business and personal information.
In the past five months, Google and four other organizations—with little in common except for their use of AI agents—have acknowledged vulnerabilities that exploit one agent inside a targeted network to spread harmful instructions to other internal agents. The technique is a special form of prompt injection that targets not the LLM but a particular agent, such as one for translation or data analysis.
Independent researcher Syed Anas Mohiuddin tested agents from organizations including Google, JP Morgan Chase, Weaviate, Rapid7, the French government’s interministerial digital directorate, and the US federal government. His proof-of-concept attacks exploit trust gaps in MCP, short for Model Context Protocol.
Many special-purpose agents lack the guardrails that might normally mitigate the most harmful consequences of a prompt injection. And since MCP servers store credentials for each agent—and agents are built to trust every other internal agent—an exploit that would have been rejected by the LLM succeeds.
Google’s MCP toolbox for databases (googleapis/mcp-toolbox) had a severity rating of 8. A crafted path parameter could make the toolbox follow a redirect to an internal endpoint and send requests on the attacker’s behalf. Google’s fix involved applying an allow-list of IP ranges and block lists.
Syed is calling the class of attack “protocol pivoting” because the exploits work when an app or server uses MCP to assign a task to an agent and the agent then forwards malicious instructions to another agent using a different communication method such as Google’s Agent-to-Agent (A2A) protocol.
“The lesson I’d want people to take away is that anything passed from an LLM to your tool should be treated like input from a stranger on the internet,” said Douglas McKee, director of vulnerability intelligence at Rapid7.