MCP Protocol Pivoting: Securing Agent-to-Agent Trust Boundaries

Seed story: "MCP for agent-to-agent comms may be the riskiest protocol you’ve never heard of" (Ars Technica) · search original Written from facts verified across 3 report(s) — original explainer, not a copy or translation. Sources at the end.

Independent researcher Syed Anas Mohiuddin has exposed a critical security gap in the Model Context Protocol (MCP), the emerging standard for agent-to-agent communication, by demonstrating how "protocol pivoting" can spread malicious prompts across internal networks. With vulnerabilities identified in systems from major organizations including Google, JP Morgan Chase, and the US federal government, developers must now re-evaluate their trust boundaries to prevent server-side request forgery and data exfiltration.

The Rise of MCP and Recent Vulnerability Disclosures

Independent researcher Syed Anas Mohiuddin recently documented a series of critical vulnerabilities affecting AI agents from major entities, including Google, JP Morgan Chase, Rapid7, and the US federal government. These disclosures, spanning a five-month period leading up to October 2026, highlight significant security gaps in the Model Context Protocol (MCP). As MCP becomes the standard for agent-to-agent communication within internal networks, these findings reveal how easily trust boundaries can be compromised.

The identified risks vary in severity and impact:

Rapid7 (CVE-2026-97228): Rated 2.7/10, this vulnerability has been fixed by the company.
Google MCP Toolbox: Rated 8/10, this issue stemmed from the lack of a CheckRedirect policy and failure to validate target IP addresses.
Attack Vector: The technique, known as "protocol pivoting," allows malicious prompts injected into one agent to spread harmful instructions to other internal agents.

For developers, this underscores the urgent need to harden MCP integrations. Without proper validation, these systems are susceptible to server-side request forgery (SSRF), potentially enabling unauthorized network requests and data exfiltration across your infrastructure.

Understanding Protocol Pivoting Attack Vectors

Protocol pivoting exploits the inherent trust assumptions in MCP-based architectures. When an agent receives a malicious prompt, it does not treat the instruction as untrusted data. Instead, it propagates the harmful directive to other internal agents via MCP channels. This mechanism effectively bypasses perimeter defenses, allowing a single compromised entry point to cascade across the entire internal network.

The core issue is the lack of validation at the trust boundary. As seen in the disclosed vulnerabilities, agents often forward requests without verifying the origin or intent of the instructions. This creates a dangerous chain of custody where:

Malicious prompts are injected into a primary agent.
Instructions are relayed to secondary agents via MCP.
Internal systems execute unauthorized commands based on the propagated data.

For developers, this shifts the security model from securing endpoints to securing the communication fabric itself. You must assume that any agent-to-agent message could be a vector for lateral movement, requiring strict input sanitization and intent verification at every hop.

Technical Analysis of SSRF and Trust Boundary Failures

The most critical technical flaw identified is a server-side request forgery (SSRF) vulnerability in Google’s mcp-toolbox for databases. This issue, rated with a severity of 8, stemmed from two specific omissions:

The absence of a CheckRedirect policy.
A failure to validate target IP addresses.

These gaps allowed malicious prompts to trigger unauthorized network requests, potentially enabling data exfiltration. Google reportedly resolved this by implementing an allow-list of IP ranges and block lists to reject unsafe base URLs during startup.

For developers, this highlights a common pitfall in agent-to-agent communication: assuming internal network traffic is inherently safe. When building MCP-based tools, you must explicitly validate every outbound connection. Relying on default configurations without strict IP validation creates a direct path for attackers to pivot from one compromised agent to sensitive internal resources.

Architectural Mitigations for Secure Agent Communication

Developers can harden MCP deployments by enforcing strict network controls at the application layer. Since the protocol often operates within internal networks, the primary defense is preventing unauthorized outbound connections before they occur. This requires validating the destination of every request rather than trusting the agent's intent.

Key defensive strategies include:

Implementing IP allow-lists to restrict traffic to known, trusted service ranges.
Applying block lists to explicitly reject private or reserved address spaces.
Validating base URLs at startup to ensure no unsafe endpoints are configured.

Google’s remediation for its MCP toolbox vulnerability exemplifies this approach. By rejecting unsafe base URLs during initialization and enforcing IP range checks, the system mitigates SSRF risks. For developers, this means integrating these validation checks into your agent’s bootstrap process, ensuring that even if a prompt injection succeeds, the resulting network request is immediately blocked by infrastructure controls.

Implications for Enterprise AI Agent Deployment

For enterprises deploying AI agents in operational workflows, these disclosures signal a critical shift in security posture. The identified vulnerabilities in systems at Google, JP Morgan Chase, and the US federal government demonstrate that internal network trust models are no longer sufficient. When agents communicate via MCP, a compromised node can act as a pivot point, effectively bypassing traditional perimeter defenses.

Organizations must now re-evaluate how they handle data exfiltration risks within their own infrastructure. Key considerations include:

Auditing existing MCP integrations for unvalidated target IP addresses.
Implementing strict allow-lists for base URLs to prevent unsafe requests.
Reviewing agent permissions to limit lateral movement capabilities.

This means developers and security teams can no longer assume that internal agent-to-agent traffic is inherently safe. Workflow changes are required to treat every agent interaction as a potential trust boundary, ensuring that operational efficiency does not come at the cost of data integrity.

Monitoring and Testing MCP-Based Systems

Auditing and Monitoring MCP Implementations

Developers must treat MCP integrations as critical attack surfaces, not just connectivity layers. Begin by auditing your agent configurations for trust boundary gaps, specifically checking for missing CheckRedirect policies or unvalidated target IP addresses. These oversights, seen in recent disclosures, can enable server-side request forgery (SSRF) and unauthorized data exfiltration.

To ensure resilience, implement the following proactive measures:

Prompt Injection Testing: Simulate malicious inputs to verify that one compromised agent cannot propagate harmful instructions to others via MCP.
Traffic Anomaly Detection: Monitor inter-agent communication for unexpected request patterns or destinations outside approved scopes.
Startup Validation: Enforce strict allow-lists for IP ranges and base URLs to reject unsafe connections immediately.

Regularly review logs for anomalous traffic to catch protocol pivoting attempts before they escalate.

FAQ

What is 'protocol pivoting' in the context of the Model Context Protocol (MCP)?

Protocol pivoting is an attack technique where malicious prompts are injected into one AI agent to spread harmful instructions to other internal agents via MCP. This exploits trust gaps in the protocol used for agent-to-agent communication within internal networks.

How did Google fix the vulnerability in its MCP toolbox for databases?

Google addressed the vulnerability by applying an allow-list of IP ranges and block lists to reject unsafe base URLs at startup. This fix was implemented to resolve the lack of a CheckRedirect policy and the failure to validate target IP addresses.

What are the potential security risks associated with MCP vulnerabilities?

Exploiting MCP vulnerabilities can lead to server-side request forgery (SSRF), which allows unauthorized network requests and potential data exfiltration. Independent researchers have identified these risks in AI agents from organizations such as Google, JP Morgan Chase, and the US federal government.