Researcher shows how SI agents can pass malicious commands to each other via MCP
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
Agents that trust one another need to check internal messages too, not only external ones.
According to iXBT, independent security specialist Syed Anas Mohiuddin demonstrated attacks on systems tied to Google, JPMorgan Chase, Weaviate, Rapid7 and US government infrastructure: one agent receives a malicious instruction from content or during a task and passes it to another as an ordinary assignment, and that agent executes it because it trusts the internal sender. The technique is called "protocol pivoting" and is in essence prompt injection. A flaw in a Rapid7 tool was rated 2.7 out of 10 and fixed in September; in Google's MCP Toolbox for Databases the HTTP client followed redirects to internal addresses without checking the IP (rated 8 out of 10), and Google restricted address ranges.
Sources 1