Google, JPMorgan and Governments Fix Critical MCP Flaw Threatening AI Agent Security

Google and JPMorgan Among Organizations Hit by Structural AI Agent Vulnerability

Security teams at Google, JPMorgan Chase, Weaviate, France's interministerial digital directorate (DINUM), and Indonesia's Tangerang city government have each patched the same type of vulnerability in AI agents in their Model Context Protocol servers3

3

. Independent researcher Syed Anas Mohiuddin reported all five cases, revealing a structural flaw in MCP that enables attackers to exploit one AI agent inside a targeted network to spread harmful instructions to other internal agents1

1

.

The vulnerability in AI agents stems from server-side request forgery (SSRF), where an MCP server accepts a URL, path, or endpoint from an agent and builds an outbound request without validating where the address resolves3

3

. This lack of governance and security guardrails allows whoever controls the agent to direct the server to communicate with internal systems, potentially leading to data exfiltration of database contents and sensitive business and personal information1

1

.

How Protocol Pivoting Exploits Trust Between AI Agents

Mohiuddin tested agents from organizations including Google, JPMorgan Chase, Weaviate, Rapid7, the French government's interministerial digital directorate, and the US federal government1

1

. His proof-of-concept attacks exploit trust gaps in the Model Context Protocol, the standard AI apps and agents use to communicate with each other inside an internal network. Many special-purpose agents lack the guardrails that might normally mitigate the most harmful consequences of indirect prompt injection1

1

.

Mohiuddin calls this attack class "protocol pivoting" because exploits work when an app or server uses MCP to assign a task to an agent, and the agent then forwards malicious instructions to another agent using a different communication method such as Google's Agent-to-Agent (A2A) protocol1

1

. "AI agents give attackers a fresh set of connections to walk across," Douglas McKee, director of vulnerability intelligence at Rapid7, explained. "Someone plants text in content, an agent will read it then pass it along to another agent as a normal delegated task, and that second agent runs it because it trusts whoever handed it the work"1

1

.

Critical Fixes Deployed Across Major Organizations

Google's MCP Toolbox for Databases, tracked as CVE-2026-14540 with a severity rating of 8.0 out of 10, initialized its HTTP client with no CheckRedirect policy and failed to validate target IP addresses1

1

3

3

. A crafted path parameter could make the toolbox follow a redirect to an internal endpoint and send requests on the attacker's behalf. Google's fix involved applying an allow-list of IP ranges and block lists, rejecting unsafe base URLs at startup instead of on first request1

1

.

JPMorgan's open-source repository included a documentation-search MCP server where one tool fetched any URL the caller supplied without validation3

3

. JPMorgan's Responsible Disclosure team confirmed the medium-severity finding and deployed a fix. Weaviate restricted its Google module's endpoint settings to Google API hosts, while DINUM's official MCP server for France's open-data platform was patched with a commit titled "harden SSRF on external APIs"3

3

.

Rapid7 fixed CVE-2026-97228, a vulnerability in its Bulk Export MCP server that allowed GraphQL injection, though it carried a low severity rating of only 2.7 out of 101

1

3

3

.

US Federal Government Servers Remain Vulnerable

On September 2, Mohiuddin privately reported security risks of AI agent architectures in five MCP servers under the US federal government's General Services Administration's Technology Transformation Services3

3

. These include servers for Veterans Affairs benefits claims, CMS Blue Button, regulations.gov, USASpending, and CDC PLACES. All five remain in triage and unfixed. In the Veterans Affairs case, the server logs full error responses from the benefits API without redaction, potentially exposing a veteran's name, Social Security number, date of birth, and address3

3

.

Thousands of MCP Servers Operate Without Governance

OX Security analyzed 15,465 publicly indexed MCP servers across 5 MCP registries, deduplicated to 5,095 unique hostnames, revealing systemic supply chain threats2

2

. Their findings show 15.6% of hostnames resolve to infrastructure outside the United States, including 19 in China and 18 in Russia, creating data residency risks where agents may send data to jurisdictions security teams never approved2

2

. Additionally, 0.45% route traffic through consumer tunneling services, mainly ngrok-free, meaning these publicly listed servers run from personal machines and home networks2

2

.

Dangling domains present another risk: 2.3% of analyzed servers no longer resolve, with six sitting on expired domains that anyone can register for $4 to $12 a year2

2

. A new owner would inherit an established server identity along with requests from any agent still configured to call it. MCP marketplaces have no equivalent to security vetting, allowing anyone to write a server, push it, and publish it without review2

2

.

Organizations Abandon Zero-Trust Principles in Rush to Deploy AI

The fact that protocol pivoting worked across five organizations with nothing in common other than the use of MCP signals a systemic problem1

1

. In organizations' rush to build sprawling agentic architectures, they have abandoned zero-trust principles, a core security principle where networks verify every connection regardless of source1

1

.

Markus Vervier, a researcher at X41 D-Sec who has also devised AI attacks exploiting MCP, describes the technique as indirect prompt injection1

1

. "The fact that the malicious prompt can come from a different protocol (e.g., A2A) and manifests when used over another protocol is not strictly required for such attacks to work. It is, of course, unexpected and hard to mitigate in general," he told Ars Technica1

1

.

Mohiuddin will present his findings at MCPCon North America in San Jose on October 233

3

. Watch for enterprises to reassess their AI agent deployments and implement stricter validation controls as awareness of these structural vulnerabilities spreads across the industry.