MCP Protocol Pivoting: Securing Agent-to-Agent Comms Against SSRF

Seed story: "MCP for agent-to-agent comms may be the riskiest protocol you've never heard of" (Ars Technica) · search original Written from facts verified across 3 report(s) — original explainer, not a copy or translation. Sources at the end.

Independent researcher Syed Anas Mohiuddin has demonstrated that the Model Context Protocol (MCP) contains critical trust gaps that allow a single compromised agent to propagate malicious instructions across internal networks. By exploiting "protocol pivoting" between MCP and other standards like Google's Agent-to-Agent protocol, attackers can trigger server-side request forgery (SSRF) to exfiltrate data, a risk highlighted by vulnerabilities in systems ranging from Google's MCP toolbox to the US federal government.

Proof-of-Concept Attacks on Major Enterprise Agents

Independent researcher Syed Anas Mohiuddin recently demonstrated the tangible risks of these trust gaps by executing proof-of-concept attacks on AI agents deployed by major organizations. His targets included systems from Google, JP Morgan Chase, and the US federal government, alongside entities like Weaviate and the French government’s interministerial digital directorate. These demonstrations highlighted how a single compromised agent can leverage the Model Context Protocol (MCP) to propagate malicious instructions across internal networks.

The core mechanism involves what Mohiuddin terms "protocol pivoting." By exploiting the implicit trust between distinct communication standards, such as MCP and Google’s Agent-to-Agent (A2A) protocol, attackers can bypass standard security controls. This technique effectively turns the agent architecture into a vector for server-side request forgery (SSRF).

For developers, this implies that standard isolation strategies are insufficient. The attacks enabled unauthorized network requests and data exfiltration, proving that:

Trust boundaries between protocols must be explicitly defined.
Internal agent communications require rigorous validation.
Compromised nodes can act as launchpads for broader network attacks.

Understanding Protocol Pivoting and Trust Boundaries

Protocol pivoting exploits the implicit trust boundaries between distinct communication layers, specifically the Model Context Protocol (MCP) and Google’s Agent-to-Agent (A2A) standard. When an agent is compromised, it leverages these unverified connections to propagate malicious instructions across the internal network. This mechanism effectively turns a single point of failure into a lateral movement vector, bypassing traditional perimeter defenses.

The technical risk centers on how these protocols handle request validation. Key vulnerabilities include:

Initializing HTTP clients without a CheckRedirect policy.
Failing to validate target IP addresses during connection setup.
Relying on unverified base URLs that allow unauthorized network requests.

For developers, this highlights a critical gap in current agent architectures. Without explicit allow-lists for IP ranges and strict rejection of unsafe URLs at startup, your agents remain exposed to server-side request forgery (SSRF). This means that securing agent-to-agent comms requires treating protocol handshakes as high-risk trust boundaries rather than internal conveniences.

Case Study: The Google MCP Toolbox SSRF Vulnerability

CVE-2026-97228, a severity-8 vulnerability in googleapis/mcp-toolbox, highlights a critical gap in how developers secure agent infrastructure. The flaw allowed server-side request forgery (SSRF) because the toolbox initialized its HTTP client without a CheckRedirect policy. Consequently, the system failed to validate target IP addresses, permitting malicious redirects to internal resources.

This oversight demonstrates that standard HTTP hygiene is non-negotiable in multi-agent environments. The remediation required specific defensive measures:

Applying an allow-list of IP ranges.
Implementing block lists for unsafe base URLs.
Rejecting invalid targets at startup.

For developers, this means auditing client configurations beyond simple API calls. Without these checks, a compromised agent can pivot through the MCP layer to exfiltrate data, turning a routine database connection into a high-risk attack vector.

Comparative Risk Assessment: Rapid7 and Severity Ratings

The contrast between Rapid7 and Google highlights how network context dictates vulnerability criticality. Rapid7’s CVE-2026-97228 received a low severity rating of 2.7, reflecting a contained risk within its internal infrastructure. In contrast, the Google MCP toolbox vulnerability was rated 8, signaling a far more dangerous exposure. This disparity illustrates that identical protocol flaws can carry vastly different weights depending on the surrounding trust boundaries.

The critical difference lies in the scope of potential impact. Rapid7’s issue was fixed in September 2026 with minimal external threat, whereas Google’s flaw allowed broader server-side request forgery. For developers, this means security assessments cannot rely solely on the protocol specification. Instead, you must evaluate:

The specific network exposure of the agent
The strictness of IP validation policies
The potential for cross-protocol trust exploitation

Understanding these variables is essential for prioritizing patches in multi-agent environments.

Hardening MCP Implementations Against SSRF

Developers can mitigate these risks by enforcing strict network boundaries at the application layer. The most effective defense, as demonstrated by the remediation for the Google MCP toolbox vulnerability, involves validating target IP addresses before any request is initiated. By applying an allow-list of approved IP ranges and maintaining block lists, systems can reject unsafe base URLs during the startup phase. This prevents the HTTP client from blindly following redirects or connecting to internal services, directly addressing the root cause of the severity 8 flaw.

Key implementation steps include:

Initializing the HTTP client with an explicit CheckRedirect policy.
Validating all target IPs against a predefined allow-list.
Rejecting connections to known malicious or internal-only ranges at startup.

These controls ensure that agent-to-agent communications remain within trusted perimeters. For development teams, this means shifting security checks from runtime to initialization, reducing the attack surface for server-side request forgery and protecting sensitive data from unauthorized exfiltration.

Governance Strategies for Multi-Agent Architectures

Developers building distributed agent systems must treat identity verification as a continuous process rather than a one-time handshake. When agents communicate via MCP, the absence of strict governance allows a single compromised node to propagate malicious instructions across the entire network. To prevent this lateral movement, teams should implement rigid communication governance that validates every request against a known set of authorized peers.

Effective strategies include:

Enforcing mutual authentication between all agent nodes to verify identity at every hop.
Applying strict allow-lists for permitted internal IP ranges to block unauthorized network requests.
Monitoring for anomalous request patterns that indicate potential protocol pivoting attempts.

By structuring these controls, developers can ensure that a breach in one component does not cascade into a full system compromise. This approach shifts the security posture from reactive patching to proactive containment, protecting sensitive data from exfiltration through forged server-side requests.

FAQ

What is 'protocol pivoting' in the context of AI agents?

Protocol pivoting is an attack vector that exploits trust gaps between different communication protocols, such as the Model Context Protocol (MCP) and the Agent-to-Agent (A2A) protocol. This technique allows a compromised agent to spread malicious instructions to other internal agents, potentially leading to server-side request forgery (SSRF).

How did the vulnerability in Google's MCP toolbox for databases occur?

The vulnerability stemmed from the MCP toolbox initializing its HTTP client without a CheckRedirect policy and failing to validate target IP addresses. To fix this, Google applied an allow-list of IP ranges and block lists to reject unsafe base URLs at startup, addressing a severity rating of 8.

Which organizations were targeted in the proof-of-concept attacks on MCP?

Independent researcher Syed Anas Mohiuddin conducted proof-of-concept attacks on AI agents from Google, JP Morgan Chase, Weaviate, Rapid7, the French government's interministerial digital directorate, and the US federal government. These attacks demonstrated how trust gaps in the Model Context Protocol could be exploited to compromise internal agent networks.