MCP protocol pivoting flaws hit Google, Rapid7 agents

MCP protocol pivoting has moved from a theoretical concern to a documented attack class, after an independent researcher showed that AI agents at Google, Rapid7, and several other organizations could be manipulated into passing malicious instructions down a chain of trusted internal systems. The findings expose a structural weakness in how modern agentic architectures handle trust between machines.

What the Researcher Found

Syed Anas Mohiuddin tested agents deployed by Google, JP Morgan Chase, Weviate, Rapid7, the French government's interministerial digital directorate, and the US federal government. That's a long list. Over the past five months, five of those organizations acknowledged vulnerabilities that let one compromised agent inside a network spread harmful instructions to other internal agents, and they're not the only ones who should worry. But five of them did admit it.

The vector is a narrow form of prompt injection. It doesn't target the large language model directly. Instead, an attacker aims at a specific agent, say one built for translation or data analysis, and the guardrails inside those agents, where they exist at all, tend to be thin. They forward the instruction. They forward it to the next agent in the chain. And that second agent trusts the first, so it complies.

MCP protocol pivoting gets its name because the exploit crosses protocol boundaries. An app or server uses MCP, short for Model Context Protocol, to assign a task to an agent. That agent then hands the malicious instruction to another agent over a different channel, such as Google's Agent-to-Agent protocol or emerging standards like the Agent Network Protocol. Trust and authorization often get lost in that translation.

"AI agents give attackers a fresh set of connections to walk across," said Douglas McKee, director of vulnerability intelligence at Rapid7. "Someone plants text in content, an agent will read it then pass it along to another agent as a normal delegated task, and that second agent runs it because it trusts whoever handed it the work."

Two Bugs, Two Very Different Scores

The Rapid7 flaw, tracked as CVE-2026-97228, carried a severity rating of just 2.7 out of 10. The company fixed it last month. The Google issue was another matter entirely, scoring an 8.

That bug lived in an MCP toolbox for databases. It's called googleapis/mcp-toolbox. The component initialized its HTTP client without a CheckRedirect policy, the settings that govern how a server responds when a URL errors out or redirects elsewhere, and that's a gap you don't want sitting in production code. The client also failed to validate target IP addresses. So the result was a server-side request forgery. That's a class of vulnerability. It tricks a web server into making unauthorized network requests, and they're the kind attackers love because the server does the dirty work for them.

Mohiuddin put it plainly. A crafted path parameter could push the toolbox into following a redirect to an internal endpoint. Then it sends requests on the attacker's behalf. Google's remedy applied an allow-list of IP ranges alongside block lists, and now rejects an unsafe base URL at startup rather than on first request, which means the failure surfaces before anyone can exploit it. That's what a real SSRF guard looks like. Mohiuddin noted it's also more work than most MCP servers have bothered to do.

Not Everyone Agrees on the Label

Markus Vervier, a researcher at X41 D-Sec who has built his own AI attacks against MCP, pushes back on the branding. For him, the technique is simply indirect prompt injection. The fact that the malicious prompt can arrive over one protocol and detonate over another is not strictly required for the attack to function, he said. It is, he allowed, unexpected and hard to mitigate in general.

The pivoting technique worked across five organizations with almost nothing in common except their use of MCP. That commonality is the story.

Why Zero Trust Got Left Behind

MCP is new. It's already everywhere. The protocol has spread faster than anyone has had time to test and harden it, and in the rush to build sprawling agentic architectures, organizations have quietly abandoned a core security principle: zero trust. We've let it slip. They don't test it.

Under that model, networks get designed on one assumption. One or more nodes may already be infected. Engineers building to that standard require any node to authorize itself before conducting sensitive transactions with another, and that requirement doesn't bend for anyone. MCP servers store credentials for each agent, and agents are built to trust every other internal agent. So an exploit that the LLM itself would have rejected sails through.

McKee's summary of the underlying problem is blunt. Anything passed from an LLM to a tool should be treated like input from a stranger on the internet, because in a prompt injection scenario, that is exactly what it is.

The Old Bugs Never Left

Strip away the AI framing. The vulnerabilities underneath are familiar. Injection and SSRF. The fixes haven't changed in twenty years, and that's a fact you can't ignore, because the same old flaws keep showing up in systems that people swear are modern and secure. But what changed is the attack surface.

• Agents lack the guardrails that would normally blunt a prompt injection.
• MCP servers hold credentials for every agent they serve.
• Inter-agent trust is implicit rather than verified.
• Protocol boundaries create gaps nobody is watching.

McKee credited Mohiuddin for giving the technique a name, because a name is what gets defenders and standards bodies to actually design for a threat. The hallway between the doors, as he described it, is where MCP protocol pivoting lives. Every protocol checks its own front entrance. Nobody patrols the space in between.

For organizations deploying agents at scale, the practical takeaway is uncomfortable. It's a hard truth. The chain of delegation that makes agentic systems useful is the same chain that carries the attack, and that's the part nobody wants to hear when they're shipping these systems into production. Fixing it means treating every handoff as untrusted. Every single one. Even when both sides are supposed to be on the same team, you can't assume they are.