MCP’s Trust Chain Lets Malicious Instructions Travel Between AI Agents

Introduction

As organizations divide translation, data analysis, database access, and other tasks among specialized AI agents, the Model Context Protocol, or MCP, is becoming a key way to connect applications, tools, and agents. Research described by Ars Technica suggests that the weakest point may not be the language model itself, but the trust relationship between agents. An attacker can place malicious instructions in content read by one agent and rely on that agent to pass the instructions downstream as an apparently legitimate assignment.

Key points

• The target is the agent chain, not only the model. A specialized agent may have fewer safeguards than a general-purpose assistant. If it treats another internal agent as trustworthy, it may forward an injected instruction without adequately inspecting it.
• Protocol boundaries can become escalation paths. The researcher Syed Anas Mohiuddin calls the pattern “protocol pivoting”: an attack begins through one communication path, then exploits assumptions between MCP and systems such as Google’s Agent-to-Agent protocol. Another researcher characterized the technique as a form of indirect prompt injection, noting that the cross-protocol aspect is not strictly required.
• Old vulnerabilities gain new reach. Several examples involved server-side request forgery, or SSRF. Google’s database MCP toolbox was reported to have lacked appropriate redirect handling and target-IP validation, allowing a crafted path to redirect a request to an internal endpoint. Google addressed the issue with IP allowlists and blocklists and by rejecting unsafe base URLs earlier in the process.
• The severity of individual bugs varies. A Rapid7 vulnerability received a 2.7 severity score, while the Google case was rated 8. The different scores do not erase the shared architectural lesson: components may protect their own entry points while failing to authenticate the tasks moving between them.

Why it matters

MCP is not automatically unsafe. The concern is that agentic architectures are expanding faster than their security controls. Zero trust remains relevant inside an AI workflow: an internal agent should not receive automatic authority merely because another internal agent issued a request.

Organizations should treat every model-generated tool argument and every forwarded agent instruction as untrusted input. Network destinations, redirects, credentials, and tool permissions need explicit limits. Each protocol transition should trigger fresh authorization rather than inherit an upstream decision, and logs should make the full chain auditable. The central lesson is simple: an MCP connection is not just a data pipe. It can become a privilege-carrying execution path, so security controls must cover the hallway between agents as carefully as they guard each front door.

Source: Ars Technica AI