Category: AI Agent Security | Reading time: 5 min
What Was Reported
On 5 October 2026, Ars Technica reported research by independent security researcher Syed Anas Mohiuddin showing that Google and four other organisations have acknowledged vulnerabilities in their Model Context Protocol (MCP) servers over the past five months. Mohiuddin calls the attack class "protocol pivoting": "a multi-step attack in which an adversary gains initial access through one protocol, exploits trust assumptions between protocols, and escalates to capabilities only accessible via a different protocol."
In a typical chain, an attacker plants text in content an MCP tool returns. The orchestrating agent reads it and passes it to a subagent as an ordinary delegated task, for example over Google's Agent-to-Agent (A2A) protocol. The subagent trusts its orchestrator and runs the instruction. If that subagent holds an MCP server with a server-side request forgery (SSRF) flaw, the request now comes from inside the trust boundary with the subagent's network position and permissions.
The Confirmed Findings
Mohiuddin's own write-up lists five organisations whose security teams confirmed and fixed the same SSRF mistake independently:
- Google: CVE-2026-14540 in MCP Toolbox for Databases (`googleapis/mcp-toolbox`), CVSS 8.0, published 31 July 2026. The HTTP client had no redirect policy and did not validate target IP addresses. - JPMorgan Chase: a documentation-search MCP server forked from an AWS project, where one fetching tool applied a domain allowlist and its sibling did not. JPMorgan confirmed the finding and deployed a fix. - Weaviate: a fix restricting the Google module's endpoint values to Google API hosts. - France's DINUM: the official data.gouv.fr MCP server, hardened against SSRF on 4 September 2026. - Tangerang City government (Indonesia): a Wazuh MCP server whose SSRF check rejected literal IPs but never resolved hostnames.
Rapid7 separately published CVE-2026-97228 (CVSS 2.7) for an unescaped identifier in its Bulk Export MCP server and fixed it last month. Mohiuddin has also filed findings against five MCP servers built for the US federal government, which remain in triage. He is due to present the work at MCPCon North America in San Jose on 23 October.
The Debate
Not everyone accepts a new name. Markus Vervier of X41 D-Sec told Ars the technique is a subclass of indirect prompt injection, though "unexpected and hard to mitigate in general." Rapid7's Douglas McKee described the gap this way: "Each protocol was built assuming it lived on its own, so each one checks its own front door while nobody watches the hallway in between."
Why Enterprise Buyers Should Care
None of these bugs are exotic. They are SSRF and injection, and the fixes are well known. The new part is where they sit. In a multi-agent system, authorisation that was checked at the first hop is assumed at every hop after it, and no single component looks compromised because each one did what it was designed to do.
For regulated enterprises wiring MCP and A2A into production, the questions are concrete. Does a delegated task carry the original requester's authority, or the subagent's? Is every tool call checked against policy at the moment it executes, regardless of which agent handed it over? And when something goes wrong, is there a record of each hop that shows who asked, what was allowed, and what was refused? Per-protocol defences do not answer those questions. Checks at the point of action, and a record that follows the action across protocols, do.
Source: Ars Technica · Protocol Pivoting, Four Months Later (Mohiuddin) · Protocol Pivoting paper (Zenodo) · IETF draft: MCP Security Considerations