MCP protocol faces security challenges

An independent researcher, Syed Anas Mohiuddin, revealed vulnerabilities in the Model Context Protocol (MCP) that could allow malicious generative instructions to move between AI agents. These flaws stem from the default trust between agents and the way MCP servers store agent identifiers.

Attack method involves server-side request forgery

Mohiuddin demonstrated that a well-crafted generative instruction directed at the correct agent could lead to a server-side request forgery (SSRF) vulnerability. This allows a web server to perform unauthorized network requests, which are hard to detect because each protocol only monitors its own entry point.

Multiple organizations acknowledged MCP vulnerabilities

Over the past five months, several major organizations, including Google, JP Morgan Chase, Weaviate, Rapid7, the French Interministerial Digital Directorate, and the U.S. federal government, confirmed vulnerabilities related to the MCP protocol. Each case involved an attacker persuading an AI agent to send malicious instructions to other agents.

MCP is an open-source framework for AI systems

The Model Context Protocol (MCP) is an open and open-source framework launched by Anthropic in November 2024. It aims to standardize how AI systems, such as large language models (LLMs), integrate and share data with tools, systems, and external data sources.

MCP was adopted by major AI providers

Following its launch, the MCP protocol was adopted by major AI providers like OpenAI and Google DeepMind. In December 2025, Anthropic donated the protocol to the Agentic AI Foundation, a fund under the Linux Foundation, to help establish benchmarks for agent reliability and security.

MCP faced criticism from major AI companies

In March 2026, two major AI companies cast doubt on the MCP's viability. Perplexity's technical director announced the company was moving away from MCP in favor of classical REST APIs. Cloudflare also criticized the protocol's architecture for being unsuitable for large-scale AI agents.

Vulnerabilities exposed weaknesses in enterprise systems

Mohiuddin's proof-of-concept attacks showed that MCP servers store agent identifiers and that agents trust each other by default. This allows an attacker to send malicious instructions to other agents, which then execute them because of the trust relationship.

Vulnerabilities vary in severity

The severity of the vulnerabilities found in different organizations varied. At Rapid7, the vulnerability was assigned a severity rating of 2.7 out of 10, while at Google, the issue was rated 8 out of 10. Google's fix involved implementing IP address whitelists and blacklists to prevent unauthorized requests.

New attack method called "protocol pivoting"

Mohiuddin introduced the concept of "protocol pivoting," where an attacker uses one protocol to gain access and then exploits trust assumptions to expand their capabilities using another protocol. This method can bypass security measures that rely on the assumption of trust within a single protocol.

Expert highlights protocol's rapid adoption

Markus Vervier, from X41 D-Sec, noted that the fact that "protocol pivoting" worked across multiple organizations using MCP is remarkable. He argued that the protocol's rapid adoption outpaced its testing and reinforcement, leading to security risks.

MCP receives significant update in late 2026

By late July 2026, the Model Context Protocol (MCP) underwent its most significant update since its launch. The update made the core of the protocol stateless and introduced a deprecation policy with a minimum 12-month window before features are removed.