The Unknown MCP Protocol for Agent-to-Agent Communication Could Be the Most Dangerous Yet

Meta Description: Google and four other organizations acknowledged AI agent prompt-injection flaws that let one internal agent spread harmful instructions through MCP.

Tags: AI agent security, prompt injection, Model Context Protocol, enterprise AI, MCP vulnerabilities

Featured Image: Abstract AI network diagram showing connected agents and a compromised path, no real people, no company logos, no text.

The growing use of AI agents in millions of organizations has opened a new attack surface: one trusted internal agent can be manipulated into spreading malicious instructions to another. Over the past five months, Google and four other organizations, five organizations in total, have acknowledged AI agent flaws of this kind, showing that the problem is not limited to a single company or product.

Background: AI Agents Turn Prompt Injection Into Chain Risk

AI agents are software systems that use large language models to carry out tasks, often connecting to tools, databases, or other services. Prompt injection is an attack method in which malicious text placed in a system's context causes it to follow unintended instructions. The issue described here is a narrower form of prompt injection. The attack is aimed less at the model itself and more at a specific agent, for example one built for translation or data analysis. Built-in safeguards, where present, are frequently too weak; where absent, nothing blocks the next hop. A weak guardrail can pass an attacker's instruction to another agent in the same workflow. A later agent may explicitly trust the first one and therefore obey the redirected command. For users of enterprise AI, that means a workflow may look routine while a compromised step changes its task. The result is a route for malicious actions, including exfiltrating database contents and sensitive business and personal information.

Development: Five Months of Disclosures and MCP Trust Gaps

The organizations that acknowledged the issue share little besides their use of AI agents. Independent researcher Syed Anas Mohiuddin tested agents from organizations including Google, JP Morgan Chase, Weviate, Rapid7, the French government's interministerial digital directorate, and the US federal government. The proof-of-concept attacks rely on trust gaps in MCP, which stands for Model Context Protocol. MCP provides one channel for AI applications and agents to exchange information within an internal network. The disclosures suggest that trust between connected agents can be weaponized when one agent is compromised. The problem is difficult to stop because the harmful instruction does not arrive from an obvious outside user. It moves through an internal chain that other agents are designed to accept. The trust model is the weak link: an agent that receives a message from a trusted peer has little reason to reject it.

Latest Progress: A Pattern Across Different Types of Organizations

The past five months have not produced one isolated bug, but a repeated pattern: a targeted network contains multiple agents, one is abused, and the harmful instruction propagates. The same list of tested organizations includes Google, JP Morgan Chase, Weviate, Rapid7, the French government's interministerial digital directorate, and the US federal government. That spread matters because it suggests the risk is tied to a common architecture rather than one organization's software. Existing guardrails are often insufficient. The pattern also shows why defenses focused only on user input may not cover agent-to-agent messages. The next step is likely to be more attention to how agents are allowed to trust one another, especially where MCP is used to link translation, data analysis, or other specialized functions.

Current Phase: Early Disclosure, Not Yet a Known Incident Wave

The current phase is early disclosure: vulnerabilities have been acknowledged and proof-of-concept attacks have been demonstrated, but the source does not describe confirmed incidents, fixed versions, or a timeline for broader mitigation. The next signals to watch are follow-up disclosures from the named organizations, changes to MCP trust assumptions, and whether internal guardrails are strengthened enough to stop one agent from passing harmful instructions to another.