MCP trust chains expose AI agents to lateral attacks

What this is about

An investigation by independent security researcher Syed Anas Mohiuddin reveals a recurring problem in systems built from AI agents: one agent receives data or instructions from another service and treats them as trusted. Attackers can exploit that behavior to relay malicious commands through several stages. Mohiuddin calls the pattern “protocol pivoting.”

Reporting published by Ars Technica on October 5, 2026, names confirmed cases at Google, JPMorgan Chase, Weaviate, France's digital administration, and the city government of Tangerang. The affected projects share neither code nor operator. That is what makes the story important: this is not merely one programming error, but a common trust assumption in agent chains.

What the attack chain actually does

Many agent systems connect models and tools through the Model Context Protocol (MCP). An MCP server may retrieve documents, query databases, or open internal web addresses. If it follows a target supplied by an agent without validating it, the result can be server-side request forgery, or SSRF. The server then accesses internal destinations on the attacker's behalf.

In Google's mcp-toolbox, CVE-2026-14540 affected versions 0.3.0 through 1.4.0. According to the GitHub advisory, the HTTP client lacked a restrictive redirect policy and destination-IP validation. A crafted path could redirect requests toward internal or arbitrary external destinations. The flaw received a CVSS score of 8.0 and was fixed in version 1.5.0. Google added measures including blocked and allowed IP ranges and validation during connection setup.

Protocol pivoting extends this familiar SSRF problem: malicious text can travel as apparently ordinary tool output to another agent. The second agent trusts the first and executes the delegated task. An instruction can therefore move from MCP into an agent-to-agent protocol while its origin and authorization are lost along the way.

Why it matters

Agents are deployed precisely because they can access files, databases, browsers, and cloud services. A mistaken trust decision therefore has different consequences from a merely incorrect chatbot answer. It can trigger network requests, data exfiltration, or actions using stored credentials.

The cases provide verifiable evidence of a structural risk. Besides Google's high-severity flaw, Rapid7 documents CVE-2026-97228 in its Bulk Export MCP. Its 2.7 score was much lower, but it raises the same basic question: are tool parameters treated as untrusted input? France's data.gouv.fr platform and a Wazuh MCP project also published fixes for SSRF variants.

For developers, the practical consequence is clear: “internal” must not automatically mean “trusted.” Every output from a model or agent has to be validated, constrained, and authorized again at the next tool boundary.

In plain language

Imagine an office building where every employee follows every colleague's note without checking it. A visitor leaves a note at reception: “Open the server room and take the contents of this cabinet outside.” Reception forwards it to IT, and IT complies because the note came from inside the building. The problem is not only the forged note, but the lack of a check at every door.

A practical example

A shopping agent may read product data from the internet. A second agent manages orders and has access to an internal customer system. A product description contains a hidden instruction shaped like a delegated task. The shopping agent includes it in its output; the order agent sees an internal message and opens the supplied URL.

Without destination validation, that URL could point to an internal service. An allowlist of approved domains, checks on every redirect, short-lived credentials, and fresh authorization before access would stop the chain at several points. The important defense is not one filter but a combination of independent controls.

Scope and limits

• The confirmed vulnerabilities demonstrate real implementation flaws, but they do not establish known successful data theft across every named system.
• “Protocol pivoting” is the researcher's term. Other experts classify the technique as a subtype of indirect prompt injection; the terminology is not yet standardized.
• Not every MCP server is vulnerable. Risk depends on network access, permissions, destination validation, redirects, and whether multiple agents trust each other without verification.

Organizations should therefore not disable MCP across the board. More useful measures include zero-trust rules between agents, separate identities, least privilege, outbound network filters, and protocols that preserve the origin and authorization of delegated tasks. It remains unclear how reliably such controls will work across long, dynamic agent chains.

SEO & GEO keywords

MCP security, Model Context Protocol, protocol pivoting, AI agents, prompt injection, SSRF, CVE-2026-14540, Google mcp-toolbox, zero trust, agent-to-agent, cybersecurity