MCP Protocol Vulnerability Disclosed: Google, JPMorgan Chase, and Three Other Organizations Have Patched the Flaw

The Same Security Vulnerability Found Across Five Organizations

Do you know where the requests made by your AI agent actually end up? Independent security researcher Syed Anas Mohi Uddin uncovered a troubling pattern during his investigation: MCP (Model Context Protocol) servers belonging to Google, JPMorgan Chase, and three other organizations all shared the same security flaw — a tool that fetches a given URL without verifying where that URL actually points.

According to Ars Technica, all five organizations have confirmed and patched the vulnerability. The affected entities span different industries and countries: in addition to Google and JPMorgan Chase, the list includes database company Weaviate, a French government digital agency, and the municipal government of Tangerang, Indonesia. Google's vulnerability was rated 8 out of 10, placing it in the high-severity category.

What makes this especially noteworthy is that these servers were built by entirely different teams, yet they made the same mistake. This suggests the issue isn't a matter of any single team's negligence — it reflects a systemic blind spot in MCP ecosystem design practices.

MCP (Model Context Protocol) is an open protocol introduced by Anthropic in late 2024, designed to give AI models a standardized way to connect with external tools, databases, and services. Developers can package capabilities — such as web scraping, code execution, and database queries — into "MCP servers," while AI agents act as "MCP clients" that call upon these servers as needed. The protocol dramatically lowered the barrier to AI tool integration and was quickly adopted by Google, various open-source projects, and enterprise teams. However, the protocol itself does not enforce security validation of input parameters, which has led to a proliferation of servers that implement functionality without considering security boundaries — a structural reason why multiple organizations ended up with the same vulnerability.

How the Vulnerability Is Exploited: Protocol Pivoting

Mohi Uddin described an attack path he calls "protocol pivoting," which reveals how attackers can reach these flawed tools.

The attack begins with "planted text." The attacker embeds malicious content in a tool's output, which first reaches one AI agent. That agent then passes it to a second agent via another agent protocol, treating it as a normal task.

The critical weakness lies in the chain of trust: the second agent trusts the sender and executes the task. If the second agent happens to have access to that flawed, non-validating URL-fetching tool, the request now appears to come from "inside the network" — effectively bypassing perimeter defenses.

Another researcher told Ars Technica that this is essentially a form of "indirect prompt injection." Security firm Rapid7 also patched a related low-severity vulnerability last month, further confirming how widespread these issues are.

Indirect Prompt Injection is the underlying mechanism behind this class of attacks. Unlike direct prompt injection — where an attacker feeds malicious instructions directly to the model — indirect prompt injection hides malicious instructions inside external content that the model will proactively read, such as web pages, documents, or tool return values. The model then "reads in" and executes those instructions while performing its task. In multi-agent scenarios, this threat is further amplified: one agent's tool output naturally becomes another agent's "external content," and the downstream agent often skips security checks because it trusts the upstream source. Researchers warned about this attack vector as soon as large language models began gaining tool-calling capabilities, but its exploitability has grown significantly now that protocols like MCP have standardized multi-agent collaboration.

Why Inter-Agent Trust Is a Source of Risk

The central lesson from this incident is that when multiple AI agents collaborate through protocols, the default trust between them acts as an attack amplifier. Individual agents may appear secure in isolation, but when malicious instructions travel between agents disguised as normal tasks, perimeter defenses become meaningless.

Rapid7's Douglas McKee offered straightforward advice: treat anything an AI passes to your tool as if it came from a stranger on the internet. This means that regardless of which internal agent the data came from or how many layers it passed through, it should never be trusted by default.

This "zero trust" mindset is especially critical as the agent ecosystem expands rapidly. As protocols like MCP make AI tool chains increasingly long, input validation at every single link cannot be skipped.

The Fix: Verify Where Every Request Actually Goes

Mohi Uddin's proposed remediation is equally straightforward and effective: check where each request truly ends up, and use the same method to harden all tools capable of fetching URLs.

Concretely, this means deploying a unified allow list on every tool with fetching capabilities, permitting only explicitly trusted destination addresses and rejecting all unverified redirects. The strength of this approach lies in its replicability — the same defensive logic can cover all tools with similar risks, avoiding the gaps that can occur when patching them one by one.

For development teams building or operating MCP servers, this incident provides a clear checklist:

• Audit all tools that fetch external addresses based on user input
• Apply a unified destination allow list across all such tools
• Never trust input passed by an AI agent — treat it as untrusted external data without exception

Allow List is a classic access control mechanism, the counterpart to a "block list": while a block list enumerates forbidden targets and permits everything else, an allow list only permits explicitly declared trusted targets and rejects everything else by default. In network request contexts, allow lists are typically configured using domain names, IP ranges, or URL prefixes. Compared to blocking known malicious addresses one by one, allow lists provide stronger security because attackers cannot bypass them simply by registering new domains or using redirects. In the context of MCP tool fetching, true protection against protocol pivoting requires combining the allow list with logic that validates the final destination after following all redirects — validating only the initial URL while ignoring the redirect chain can still be bypassed.

Implications for AI Agent Security

When top-tier organizations like Google and JPMorgan Chase stumble over the same issue, it signals that agent security is still in its early stages and that many best practices have yet to be widely adopted. The MCP protocol delivers powerful tool-calling capabilities, but it also introduces new attack surfaces.

As more enterprises connect AI agents to production environments and grant them the ability to autonomously call tools and access external resources, the traditional security principles of input validation, source verification, and least privilege must be reintroduced into agent architectures. This incident — discovered by an independent researcher and promptly patched by multiple major organizations — serves as a valuable collective wake-up call.