The risk is emerging as enterprises connect agents to databases, internal applications and automated workflows through the Model Context Protocol, or MCP. The commercial appeal is clear. MCP can make it easier to assemble agents from different vendors and give them access to common tools. The security cost is that every connection creates another assumption about identity, authorization and trust.
That tradeoff could become a competitive liability for companies deploying agents faster than they can redesign their security architecture. A business may gain productivity from a network of specialized systems, but a weakness in one agent could provide an attacker with a path toward more valuable tools and data.
A trust problem between agents
Syed Anas Mohiuddin’s research update documents confirmed MCP server side request forgery findings involving systems associated with Google, JPMorgan Chase, database company Weaviate, France’s interministerial digital directorate, known as DINUM, and the Tangerang City government.
The findings point to a broader attack model that Mohiuddin calls protocol pivoting. In this scenario, an attacker does not necessarily compromise the underlying language model. Instead, the attacker places a malicious instruction inside content that an agent is expected to process. The first agent interprets that instruction as a legitimate task and passes it to another agent, which may have access to more sensitive resources.
The second agent can then treat the request as trusted because it arrived through an internal delegation path. That creates a form of lateral movement across the agent network. The payload may be natural language, but the resulting action can involve a database query, a network request or the use of a privileged tool.
This distinction matters for businesses. Conventional security programs often concentrate on protecting each application interface. They may authenticate an agent at the entrance to a service while failing to verify whether a particular task should have been delegated, whether its parameters are safe, or whether the originating agent has authority to request it.
Mohiuddin’s IETF Internet Draft describes protocol pivoting as cross protocol lateral movement involving MCP and agent delegation systems such as Google’s Agent to Agent protocol. The draft places the problem within a wider set of MCP weaknesses, including insufficient validation, excessive permissions and unsafe handling of context passed between systems.
The server can become the pivot
The practical danger is not limited to an agent’s reasoning. MCP servers often connect agents to external services and may hold credentials needed to perform those actions. If a server accepts unsafe destinations or request parameters, an attacker can use the agent workflow as a route into internal infrastructure.
A GitHub security advisory for Google’s MCP Toolbox describes a DNS rebinding vulnerability in the toolbox’s server sent events implementation. The advisory lists affected versions and identifies version 1.2.0 as the patched release.
DNS rebinding attacks can make a destination appear acceptable during an initial check and then resolve to a different address when the request is made. In an agent environment, that can turn a seemingly ordinary tool call into a request directed at an internal endpoint. The important business issue is not only the vulnerability in one product. It is the possibility that a widely reused integration becomes a bridge between public input and private systems.
For Google, a patch addresses the immediate weakness. For customers, however, remediation may require a broader review of what MCP tools can reach, which credentials they store and whether internal services accept requests from agents without additional checks.
Why scale increases the exposure
The value proposition for multi agent systems is that each agent can specialize. One may retrieve information, another may analyze it, and a third may execute an action. That division of labor can lower operating costs and improve workflow speed compared with assigning every task to a single general purpose system.
It also creates a chain of dependencies. An organization must secure not only each agent, but also the messages, tools and permissions connecting them. A failure in the least protected component can become a route to the most valuable one.
NSA guidance on MCP security identifies implicit trust relationships, unverified task propagation, context sharing, weak access control and inadequate approval workflows as key risks in AI driven automation. Those concerns describe an architectural problem rather than a single coding error.
Enterprises that treat every internal agent as trustworthy may also weaken their negotiating position with vendors. The more systems connected to an agent, the more important it becomes to demand granular permissions, auditable actions and clear limits on delegated work. Platform providers that offer those controls could gain an advantage over rivals that focus mainly on rapid integration.
Security becomes part of the AI strategy
The emerging lesson is that agentic AI is an identity and authorization problem as much as it is a model safety problem. A company that deploys agents without separating their privileges may reduce labor costs while increasing the blast radius of a compromise.
A stronger design would apply zero trust between agents, require explicit authorization for sensitive actions and isolate tools according to their business impact. Model generated inputs should be treated as untrusted data, even when they arrive from an internal agent. Requests should be validated independently at each boundary, rather than inheriting authority from the system that produced them.
Approval workflows also need to match the stakes. Reading a public document should not carry the same permissions as sending money, changing a production database or accessing confidential customer records. Logging must capture not only what an agent did, but which agent requested it, what context influenced the request and why the action was allowed.
The strategic question for enterprise buyers is therefore not simply which MCP compatible tools are available. It is whether the surrounding trust model can support large scale deployment without turning convenience into an attack path. As companies compete to operationalize AI, security controls between agents may become as important as model quality, integration speed and inference cost.
Rebeca Smith is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna and qwen3-max. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1 and gpt-image-1-mini. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Rebeca Smith's usual length and in Rebeca Smith's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.