MCP Protocol Pivoting Attack Hits Google, Rapid7 Agents

MCP protocol pivoting attack research has quietly exposed a structural weakness inside some of the most trusted AI agent deployments in the world. The organizations affected? They've almost nothing in common. Except the technology they adopted. Over the past five months, Google and four other organizations acknowledged vulnerabilities that let one compromised agent inside a network hand malicious instructions to other internal agents, and that's a problem nobody saw coming. The technique is a specialized form of prompt injection. It doesn't target the large language model directly. It targets a particular agent, maybe one built for translation or data analysis, and relies on that agent's weak guardrails to pass the poisoned instructions further down the chain, which means the damage can spread before anyone notices.

Trust Between Agents Is the Weak Link

Independent researcher Syed Anas Mohiuddin tested agents from Google, JP Morgan Chase, Weviate, Rapid7, the French government's interministerial digital directorate, and the US federal government. He found gaps. His proof-of-concept attacks exploit weaknesses in MCP, the Model Context Protocol, which is one of the ways AI applications and agents talk to each other inside an internal network, and that makes the exposure far worse than most teams realize. Many single-purpose agents lack the guardrails that would normally blunt the worst outcomes of a prompt injection. MCP servers store credentials for each agent. Agents trust every other internal agent. So an exploit the underlying LLM would have rejected sails through anyway. In many cases, a well-crafted prompt aimed at the right agent produces a server-side request forgery, a flaw that forces a web server to make unauthorized network requests, and that's something you can't patch with a polite system prompt.

"AI agents give attackers a fresh set of connections to walk across," Douglas McKee, director of vulnerability intelligence at Rapid7, told Ars. "Someone plants text in content, an agent will read it then pass it along to another agent as a normal delegated task, and that second agent runs it because it trusts whoever handed it the work. Every piece in that chain did exactly what it was designed to do, which is what makes this so tricky to catch. Each protocol was built assuming it lived on its own, so each one checks its own front door while nobody watches the hallway in between."

Two Bugs, Two Very Different Scores

The Rapid7 finding, tracked as CVE-2026-97228, carried a severity rating of just 2.7 out of 10. Rapid7 fixed it last month. The Google bug was a different animal entirely, rated 8. It originated in an MCP toolbox for databases, googleapis/mcp-toolbox, which initialized its HTTP client without a CheckRedirect policy, the settings that govern how a server handles a URL that errors out or redirects somewhere else. Google's HTTP client also skipped validation of target IP addresses.

"A crafted path parameter could make the toolbox follow a redirect to an internal endpoint and send requests on the attacker's behalf," Syed explained.

Google's remedy applied an allow-list of IP ranges alongside block lists. The fix rejects an unsafe base URL at startup. It doesn't wait for the first request. And that is what a real SSRF guard looks like, a guard that checks its input before it ever serves a single byte of traffic, which is more work than most MCP servers have bothered to do.

Why Protocol Pivoting Is Hard to Stop

Syed calls the class of attack MCP protocol pivoting, because the exploits work when an app or server uses MCP to assign a task to an agent, and that agent then forwards malicious instructions to another agent over a different communication method. Google's Agent-to-Agent protocol, used for inter-agent delegation, is one such channel. Emerging standards like the Agent Network Protocol are others. Trust or authorization often gets lost in translation between them.

He describes protocol pivoting as a multi-step attack in which an adversary gains initial access through one protocol, exploits trust assumptions between protocols, and escalates to capabilities only reachable through a different one.

Not everyone accepts the new label. Markus Vervier, a researcher at X41 D-Sec who has devised his own AI attacks against MCP, argues that the better term remains prompt injection, and that Syed's technique is simply a subclass of it, nothing more. But they're not all on the same page.

"For me this is indirect prompt injection," he told Ars. "The fact that the malicious prompt can come from a different protocol (e.g., A2A) and manifests when used over another protocol is not strictly required for such attacks to work. It is, of course, unexpected and hard to mitigate in general."

Important. The pivoting technique worked across five organizations with essentially nothing in common beyond their use of MCP, and that reach is what makes the naming fight worth having.

Zero Trust Got Left Behind

MCP is new. And it's already everywhere before anyone has sufficiently tested and hardened it. In the rush to build sprawling agentic architectures, organizations abandoned a core security principle known as zero trust, which says you don't assume the network is safe just because it's yours. Under that model, networks are designed on the assumption that one or more nodes may already be infected. So engineers mitigate the fallout by forcing nodes to require authorization before conducting sensitive transactions with other nodes. That's the tradeoff they can't skip.

• Agents treat every other internal agent as trustworthy by default.
• MCP servers hold credentials for each agent on the network.
• Guardrails on specialized agents are often missing or lax.
• Authentication and authorization assumptions break down when instructions cross protocol boundaries.

McKee's advice to defenders is blunt. Anything passed from an LLM to a tool should be treated like input from a stranger on the internet, because in a prompt injection scenario that is exactly what it is, and you can't pretend otherwise. The bugs underneath are old friends. Injection and SSRF. And the fixes haven't changed in 20 years.

He credits the researcher for putting a name on the problem, because a name is what gets defenders and standards bodies to actually design for it.

What Comes Next

Google has already shipped its fix, and Rapid7 closed its gap last month. Syed, for his part, wants the industry to recognize protocol pivoting as its own category so that standards bodies and defenders build for it deliberately rather than discovering it one breach at a time. Whether the label sticks or fades into the broader prompt injection bucket, the underlying lesson does not change. Every protocol in an agentic chain checks its own front door. Nobody is watching the hallway in between.