Recommended Free Tools
MCP is not, by itself, an agent-to-agent messaging protocol, and the available reporting does not establish that it is the “riskiest” protocol. But when AI agents delegate work through MCP-connected tools and other protocols, malicious instructions can cross trust boundaries—and downstream agents may act on them. An October 5, 2026, Ars Technica report describes those risks alongside a separate, conventional server-side request forgery (SSRF) flaw in a Google MCP toolbox.
What MCP does—and where agents enter the picture
The Model Context Protocol (MCP) connects an AI application, or client, to servers that expose capabilities such as tools. It is not a dedicated agent-to-agent messaging protocol. A multi-agent workflow can combine MCP with separate inter-agent protocols, including A2A, so one agent may delegate work to another while relying on tools and services connected through MCP.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters for security: a handoff between agents does not automatically carry the same assumptions, permissions, or safeguards as the system that started the task. Each component may make its own decisions about what to trust and what actions to allow.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow malicious instructions can cross an agent boundary
- Untrusted content enters the workflow. An agent reads attacker-controlled text, for example in content it is asked to process.
- The first agent passes it along. The text can be relayed as part of an apparently ordinary delegated task rather than identified as an instruction from an attacker.
- A receiving agent trusts the handoff. If it treats the sending agent or its request as authoritative, it may follow the malicious instruction.
- Tools or credentials turn the instruction into an action. The consequences depend on what the receiving agent can access and whether a sensitive action requires a separate authorization check.
Ars Technica reported tests by Syed Anas Mohiuddin involving agents associated with Google, JPMorgan Chase, Weaviate, Rapid7, France’s interministerial digital directorate, and a US federal agency. That test set does not show that every named product or organization was vulnerable in the same way.
#1 Best Overall
The report calls the cross-agent technique “protocol pivoting,” a term used by the reporting researcher. Another researcher quoted in the article describes it as indirect prompt injection. The underlying issue is the combination of untrusted content, agent behavior, delegated permissions, credentials, and a receiving service’s assumptions; it does not necessarily require a defect in the language model itself.
A separate MCP-connected flaw: unsafe redirects and SSRF
The same report describes an implementation flaw in a Google MCP database toolbox. According to Ars Technica, its HTTP client lacked a redirect policy and did not validate destination IP addresses. A crafted path parameter could lead the client to follow a redirect to an internal endpoint, making a request on an attacker’s behalf. This is a familiar SSRF and redirect-validation problem in an agent-integrated service—not evidence that MCP servers generally share that vulnerability.
Ars Technica reported severity ratings of 8 for the Google issue and 2.7 out of 10 for a separate Rapid7 issue. These are incident-specific figures reported by the outlet, not a severity score for MCP as a protocol. The article said Rapid7 had fixed its issue the month before publication and that Google’s fix used allow-lists and block lists; those remediation details are attributed here to the report.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhere to enforce security in a multi-agent workflow
Assess the workflow at each point where content or authority moves, rather than treating a protocol label as a security guarantee.
Rank #3
| Workflow point | Risk to check | Control to apply |
|---|---|---|
| Content enters an agent | Instructions from untrusted text may be mistaken for trusted directions. | Treat content and tool outputs as untrusted input, including content passed by an internal agent. |
| Work is delegated to another agent | The receiver may trust the sender or inherit assumptions that were never verified. | Re-check permissions at the receiving agent and require authorization before sensitive inter-agent transactions. |
| A sensitive tool or service is invoked | Delegated credentials or broad permissions may enable unintended actions. | Enforce least privilege and authorize each sensitive action at the point it occurs. |
| An HTTP client follows a user-influenced destination | Unsafe redirects or unchecked destination IPs can expose internal services through SSRF. | Validate destinations, restrict private and internal IP ranges where appropriate, and handle redirects explicitly. |
| An MCP server accepts an access token | A token intended for another service may be accepted or passed upstream incorrectly. | Validate tokens for the receiving server, bind them to the intended resource, and do not forward a client token to upstream services. |
What MCP authorization does—and does not—protect
The MCP authorization specification makes authorization optional for implementations overall. For implementations using HTTP authorization, it describes OAuth-based protections including resource binding and server-side validation of the token’s intended audience. It also says an MCP server must not pass the client’s token through to an upstream service.
These controls help preserve authorization boundaries; they do not establish that natural-language content or tool responses are safe to obey. Microsoft’s April 2026 security guidance warns about prompt injection through tool responses and says instruction-following alone is not a security boundary. The NSA’s May 2026 release identifies risks involving serialization, trust boundaries, agent misuse, dynamic tool invocation, implicit trust relationships, and context sharing. Its accompanying information sheet says many implementations omit authentication and that permissions can be difficult to enforce or verify after initial setup.
Authentication, prompt filtering, and destination validation address different failure modes. They are defense in depth, not substitutes for one another or a guarantee that a multi-agent workflow is safe.
Why the “riskiest protocol” framing needs qualification
The available reporting establishes specific risks and incidents, not a comparative ranking of protocols. It provides no benchmark showing MCP to be riskier than other protocols. The more useful conclusion is narrower: when agents hand off content and authority, malicious instructions can travel with routine work, while familiar implementation flaws can expose services behind tools. Security depends on how the whole workflow handles trust, permissions, and network requests.
Best Value
As Douglas McKee, Rapid7’s director of vulnerability intelligence, told Ars Technica: “The lesson I’d want people to take away is that anything passed from an LLM to your tool should be treated like input from a stranger on the Internet, because in a prompt injection scenario that’s exactly what it is,” McKee said.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
