Structural flaw in MCP lets AI agents spread malicious instructions to each other

What is MCP and why it matters

MCP (Model Context Protocol) is a standard that lets AI apps and agents communicate with each other inside an internal network. As agents spread across organizations, the protocol has become a critical layer for internal communication.

How the flaw works

Proof-of-concept attacks by independent researcher Syed Anas Mohiuddin exploit trust gaps in MCP. An attacker compromises a single agent in the network, such as one handling translation or data analysis. Because guardrails inside such agents are often lax, harmful instructions get passed down the chain. The next agent explicitly trusts the first one, so it follows the directions.

This is a special form of prompt injection: the target is not the LLM itself but a specific agent inside the network.

Who is affected

Those tested include Google, JP Morgan Chase, Weaviate, Rapid7, the French government's interministerial digital directorate and the US federal government. Over the past five months, Google and four other organizations have acknowledged vulnerabilities that allow agent-to-agent spread.

Why it is hard to fix

The attack relies on the implicit trust agents place in each other. That trust relationship is part of how the protocol works, so closing the gap is an architectural problem rather than a single patch.