A structural flaw within the Multi-agent Communication Protocol (MCP) permits the propagation of malicious prompts between artificial intelligence agents, according to recent security analyses. The protocol, designed to facilitate communication and collaboration among AI agents, contains inherent trust gaps that can be exploited to spread harmful instructions.
The MCP protocol establishes a framework for agents to interact with tools, data sources, and other agents. While it incorporates security measures such as OAuth 2.0-based authentication, these are not always enforced by default, creating vulnerabilities. Security researchers have identified that the protocol's reliance on textual descriptions and the dynamic nature of AI agent behavior contribute to these weaknesses. Adversarial actors can manipulate context or inject malicious content into messages, leading agents to perform unintended actions, such as executing unauthorized commands or exfiltrating sensitive data.
One significant concern is the "confused deputy problem," where an agent with high privileges may inadvertently grant access to a lower-privileged user or another agent due to a lack of clear user context being passed through the protocol. This can lead to privilege escalation and unauthorized data access. Furthermore, the protocol's design does not always guarantee strong authentication between agents, making it possible for malicious servers to impersonate legitimate ones by using similar names or descriptions. This can lead to agents interacting with compromised endpoints rather than trusted services.
The security implications extend to the AI agent development kits themselves. Flaws discovered in Google's Agent Development Kit (ADK) for Python demonstrated how public-facing AI agents could trigger more privileged automation. These vulnerabilities could be used to manipulate code review processes, disguise malicious pull requests, or even expose credentials. While Google has since taken steps to harden its repositories, the findings highlight the broader risks associated with agentic workflows.
Researchers emphasize that while protocols like MCP provide structure and scale for AI agent interactions, they should not be considered security boundaries in themselves. The interpretation of MCP structures by AI models is text-based, making them susceptible to prompt injection and context manipulation. This means that even with a seemingly secure protocol, the underlying AI models and the data they process remain potential attack vectors. To mitigate these risks, organizations are advised to implement rigorous tooling controls, ensure context integrity, and prioritize observability and auditability in their agentic AI systems.