New Research Highlights Trust Gaps and Protocol Pivoting Vulnerabilities in AI Agents

As organizations increasingly deploy autonomous AI systems across millions of networks, security researchers have uncovered critical structural flaws in how these programs communicate. Over the past five months, Google and four other diverse organizations have acknowledged vulnerabilities that allow an attacker to leverage one internal agent to propagate harmful instructions to others. This discovery sheds light on hidden security gaps within modern agentic architectures, particularly concerning standard communication frameworks.

Independent researcher Syed Anas Mohiuddin conducted proof-of-concept tests on implementations from multiple entities, including Google, JP Morgan Chase, Weaviate, Rapid7, the French government’s interministerial digital directorate, and the US federal government. His findings focus on the Model Context Protocol (MCP), a standard designed to facilitate communication between AI applications and agents within internal networks. Because many special-purpose agents—such as those built for translation or data analysis—lack adequate guardrails, they rely heavily on implicit trust. When an MCP server stores credentials and an agent assumes every other internal node is secure, traditional safeguards can fail.

Understanding Protocol Pivoting and Trust Gaps

Mohiuddin has labeled this attack vector "protocol pivoting." The technique involves an adversary gaining initial entry through one protocol, exploiting trust assumptions between different systems, and escalating privileges to access restricted capabilities. For example, a crafted input can cause an agent to pass malicious instructions down the chain. Because the subsequent agent trusts the preceding one, it executes the command as a normal delegated task.