🤚 The Open-Palm Protocol Butler
AI agents have discovered networking, delegation, and the ancient enterprise art of trusting the wrong colleague with a badge. A new report from Ars Technica details how flaws around Model Context Protocol, or MCP, can let malicious instructions move from one agent to another inside organizations that believed they were building automation and not a marble-floored prompt-injection buffet.
Independent researcher Syed Anas Mohiuddin tested agents and systems connected to organizations including Google, JP Morgan Chase, Weaviate, Rapid7, the French government’s interministerial digital directorate, and the US federal government. The common thread was not business model, geography, or brand palette. It was the adoption of agent systems using MCP and adjacent agent-to-agent patterns before everyone had finished bolting the doors onto the carriage.
The issue is a special form of prompt injection. Instead of simply telling a chatbot to ignore its instructions, an attacker plants malicious text where one agent may read it, then relies on that agent to pass the work to another trusted internal agent. The second agent treats the handoff as legitimate because, in the grand tradition of enterprise security, it came from inside the building wearing a nice blazer.
👐 The Two-Handed Trust Collapse
MCP is designed to help AI applications and agents communicate with tools, data sources, and other components. That is useful. It is also a fresh hallway for attackers when credentials, delegation, and authorization are handled with the casual optimism of a startup office snack policy.
Many special-purpose agents do not have the same guardrails as public-facing chatbots. They may be built to translate, summarize, analyze, query databases, or perform internal tasks. When malicious instructions reach them through trusted channels, they may dutifully execute operations that the original model would have rejected. In some cases, the underlying bug is a very traditional villain wearing a new velvet cape: server-side request forgery, or SSRF.
One Google-related flaw, rated 8.0 in severity, involved the googleapis/mcp-toolbox for databases. Ars reports that the HTTP client lacked redirect controls and failed to validate target IP addresses. A crafted path parameter could make the toolbox follow a redirect to an internal endpoint and send requests on the attacker’s behalf. Google’s fix reportedly added allow-listing and block-listing so unsafe base URLs are rejected at startup.
Rapid7 also fixed a vulnerability found by the researcher, tracked as CVE-2026-97228, though it carried a much lower severity score of 2.7. The range matters. This is not one bug with one patch. It is a pattern of systems learning to delegate faster than they learn to distrust.
🌿 The Gentle Awakening of Zero Trust, Again
Mohiuddin calls the class of attacks protocol pivoting: malicious instructions cross from one communication layer into another, such as from MCP into agent-to-agent delegation, while the security assumptions get checked at the door like an inconvenient coat. Other researchers argue the broader name is still indirect prompt injection. Fine. The branding committee may continue its artisanal knife fight. The important part is that the attack works because agents treat internal context as clean when it may be carrying poisoned instructions.
Douglas McKee, Rapid7’s director of vulnerability intelligence, summarized the unpleasant elegance of the problem: every component can do exactly what it was designed to do, and the overall system still becomes dangerous. That is the sort of sentence security teams keep in their desk drawer next to antacids.
The fix is not mystical. Treat anything passed from a language model to a tool like untrusted input. Validate destinations. Restrict redirects. Scope credentials. Separate permissions. Log agent actions. Require explicit authorization for sensitive operations. Build assuming one node is compromised, because zero trust was invented precisely for moments like this, before the industry placed it in a brochure and wandered off to add agents to spreadsheets.
👑 The Gold-Leaf Reckoning
The uncomfortable truth is that agent architecture is reintroducing old web security problems through a more expensive entrance. Injection, SSRF, confused deputy behavior, overbroad credentials, and broken trust boundaries are not new. They have simply been invited to wear the modern uniform: “autonomous workflow.”
Organizations rushing into agentic systems should read this as a menu warning, not a dessert review. MCP and agent-to-agent communication may become foundational infrastructure. But foundational infrastructure deserves threat modeling before it is plugged into production databases and asked to “be proactive.”
For now, the lesson is deliciously unfashionable: do less magic, apply more boring controls, and remember that an internal agent is still software reading text from a world full of people who would absolutely put a crowbar in a prompt if given the chance.
“The agent did not go rogue; it followed instructions from the wrong chandelier.” — The Slap of Wisdom Department of Delegated Regret, inspecting the velvet-lined threat model