Security Risks Emerge as AI Agents Can Relay Malicious Commands via MCP Protocol

Image: Illustrative image · INSA - Information Network Security Agency - Government of Ethiopia · Public domain · Source

Researchers demonstrate how compromised AI agents can exploit MCP to propagate harmful instructions across corporate networks, exposing internal services to attacks and emphasizing the need for zero-trust security models.

The rapid adoption of AI agents in corporate environments has introduced a new cybersecurity vulnerability involving the communication protocols these systems use. Independent security expert Syed Anas Mohiuddin has demonstrated that a single compromised AI agent can relay malicious commands to other agents through the Multi-Channel Protocol (MCP), a communication standard allowing AI applications to connect to various tools and share data. This inter-agent trust can be exploited to escalate attacks within organizational networks.

Mohiuddin's research showcased these vulnerabilities across several major platforms linked to Google, JPMorgan Chase, Weaviate, Rapid7, the French inter-ministerial digital service, and the U.S. federal government. The attack methodology involves embedding harmful instructions within the content or tasks provided to one agent. Instead of rejecting such commands, the compromised agent forwards them to other agents as legitimate workflow tasks. Because the recipient agents trust their internal peers, they execute these instructions, which external systems might have declined.

A critical impact of this exploitation is the facilitation of Server-Side Request Forgery (SSRF) attacks. In SSRF scenarios, a compromised agent can coerce a server into making requests to hidden internal network resources that are otherwise inaccessible externally. This chain reaction can lead to unauthorized access to sensitive services and confidential data.

Security researchers describe this exploitation as a form of "protocol pivoting," where malicious instructions traverse one communication protocol only to leverage the trust mechanisms of another. Markus Vervier from X41 D-Sec highlights that these attacks fundamentally resemble prompt injection—embedding harmful commands within inputs processed by AI systems.

Two notable vulnerabilities were identified and rectified recently. An issue in Rapid7’s tool scored 2.7 out of 10 in severity and was patched in September, while a more critical flaw in Google's MCP Toolbox for Databases was rated 8 out of 10. The latter allowed an HTTP client to follow redirects to internal IP addresses without sufficient verification, potentially enabling unauthorized internal network access. Google mitigated this by implementing permitted IP range whitelisting and blocking unsafe addresses.

These findings underline the importance of adhering to zero-trust security principles in AI infrastructures. Trust should not be automatically extended to internal agents without verification. All instructions passed between AI agents must be scrutinized for potential malicious content to prevent cascading security breaches within corporate ecosystems. As AI integration deepens, robust safeguards against such multi-agent exploits become essential for organizational cybersecurity.