MCP for agent-to-agent comms may be the riskiest protocol you've never heard of

A researcher named Syed Anas Mohiuddin has demonstrated a new attack class, dubbed "protocol pivoting," that abuses the trust model built into the Model Context Protocol (MCP), the emerging standard used by AI agents to communicate inside corporate networks. By injecting malicious instructions into one agent, an attacker can get that agent to relay the harmful commands to another internal agent, which blindly executes them because it inherently trusts the first agent—even when the two use different inter-agent protocols such as Google's Agent-to-Agent (A2A). Mohiuddin found the flaw affecting five organizations with little in common besides MCP adoption, including Google, JP Morgan Chase, Weaviate, Rapid7, and French and US government systems. Rapid7's bug, tracked as CVE-2026-97228 and rated a low 2.7 severity, was patched last month, while Google's more serious issue (CVSS 8) stemmed from its mcp-toolbox for databases failing to validate redirect targets and IP addresses, enabling server-side request forgery; Google fixed it by adding IP allow/block lists and startup-time URL validation. Experts warn the underlying weaknesses are classic injection and SSRF bugs, but the rapid, unvetted rollout of agentic architectures across industries has sidelined basic zero-trust principles, leaving many MCP deployments exposed to this cross-protocol trust abuse.