Agents under attack

As organizations deploy millions of AI agents, attackers are finding ways to make them steal databases and sensitive business and personal information through malicious instructions.

Five organizations hit in five months

Google and four other organizations have disclosed vulnerabilities in the past five months that let attackers exploit one agent to spread harmful instructions to other internal agents.

How the attack works

The technique targets a special form of prompt injection at a particular agent, such as one for translation or data analysis. Weak guardrails then send the instructions to other agents down the chain.

MCP is the weak link

Independent researcher Syed Anas Mohiuddin tested agents from Google, JP Morgan Chase, Weviate, Rapid7, the French government's interministerial digital directorate, and the US federal government. His proof-of-concept attacks exploit trust gaps in MCP, short for Model Context Protocol, the standard for how AI apps and agents communicate inside internal networks.

Trust becomes a weapon

MCP servers store credentials for each agent, and agents are built to trust every other internal agent. When one agent receives malicious instructions from another, it follows them because it trusts the source.

“Someone plants text in content, an agent will read it then pass it along to another agent as a normal delegated task, and that second agent runs it because it trusts whoever handed it the work.”

Google's severe flaw

Google's MCP toolbox for databases initialized its HTTP client with no CheckRedirect policy and failed to validate target IP addresses. A crafted path parameter could make it follow a redirect to an internal endpoint and send requests on the attacker's behalf.

“A crafted path parameter could make the toolbox follow a redirect to an internal endpoint and send requests on the attacker's behalf.”

Protocol pivoting explained

Syed calls the attack class protocol pivoting because exploits work when an app uses MCP to assign a task to an agent, which then forwards malicious instructions to another agent using a different communication method like Google's Agent-to-Agent protocol.

“A multi-step attack in which an adversary gains initial access through one protocol, exploits trust assumptions between protocols, and escalates to capabilities only accessible via a different protocol.”

The zero trust problem

MCP is new and already everywhere before being sufficiently tested and hardened. Organizations building sprawling agentic architectures have abandoned zero trust, the security principle that assumes one or more network nodes may be infected.

The fix is old knowledge

Douglas McKee at Rapid7 says the bugs underneath are old friends like injection and SSRF, and the fixes have not changed in twenty years. Anything passed from an LLM to a tool should be treated like input from a stranger on the Internet.

“Anything passed from an LLM to your tool should be treated like input from a stranger on the Internet, because in a prompt injection scenario that's exactly what it is.”