- Published on
MCP for agent-to-agent comms may be the riskiest protocol you've never heard of
- Authors
- Name
- DeepHorus
Security researchers warn that the Model Context Protocol, the emerging standard enabling AI agents to communicate with one another, may be one of the riskiest protocols in modern enterprise networks. Exploits can turn a single compromised agent into a conduit for spreading malicious instructions across an organization. Such attacks can lead to exfiltration of database contents, business records, and personal information.
MCP defines how AI applications and agents exchange information inside internal networks. As millions of organizations deploy AI agents, the protocol has become an attractive target. Because MCP servers store credentials for each agent, a breach can quickly escalate.
Over the past five months, Google and four other organizations have acknowledged vulnerabilities allowing one agent to spread harmful instructions to others. Independent researcher Syed Anas Mohiuddin tested agents from Google, JP Morgan Chase, Weviate, Rapid7, France's interministerial digital directorate, and the US federal government. All shared little in common except their reliance on AI agents.
His proof-of-concept attacks exploit trust gaps in MCP through a specialized form of prompt injection. Rather than targeting the language model directly, the attack aims at a specific agent, such as one handling translation or data analysis. Since agents are built to trust every other internal agent, the recipient complies.
Guardrails inside special-purpose agents are often lax or entirely absent, allowing instructions to pass down the chain unchecked. Because the receiving agent explicitly trusts the first, prompts a language model would reject still succeed. In many cases, well-crafted inputs trigger server-side request forgery, causing a web server to make unauthorized network requests.
The findings highlight how trust relationships designed for seamless collaboration can be inverted into attack paths. Mitigation is complicated by inconsistent safeguards across agent deployments, leaving organizations exposed to machine-to-machine compromise.
Experts expect further disclosures as agent-based workflows expand. Until guardrails are standardized across MCP implementations, security teams face a widening surface of agent-to-agent trust.
