Ars Technica details cross-agent security flaws in MCP systems

A security report describes vulnerabilities that let attackers turn trust between AI agents into a route for malicious instructions, including a Google MCP toolbox flaw that could direct requests to internal network endpoints. The practical lesson for organisations using connected agents is blunt: a tool call passed through an AI system still needs to be treated as untrusted input.

Watch Desk analysis

What happened

Ars Technica reports that independent researcher Syed Anas Mohiuddin found vulnerabilities across systems used by Google and four other organisations. The report describes attacks that exploit trust between agents: malicious instructions reach one agent and are passed on to another, potentially allowing actions such as unauthorised network requests or access to sensitive information.

For Google’s database MCP toolbox, Ars says the flaw involved HTTP redirects and a failure to validate target IP addresses. The article says Google fixed it by restricting allowed IP ranges and blocking others. It also reports that Rapid7 fixed a separate vulnerability last month. These are claims in Ars Technica’s account, not a comprehensive audit of MCP deployments.

What we know

• Trust can carry the attack
  Ars describes malicious instructions passed between agents that trust one another, rather than a direct attack on the underlying language model.
• A Google toolbox flaw involved internal requests
  The report says a crafted path could trigger a redirect to an internal endpoint; Google’s reported fix added IP-range checks.
• The reported cases have different outcomes
  Ars says Rapid7 fixed its vulnerability last month and describes Google’s fix, but the packet does not establish the status of every system discussed.

Why it matters

Agent systems are often assembled from tools and services that each appear to have their own safeguards. The risk described here sits in the hand-offs: one component treats another as trusted, and harmful instructions can travel through the chain. That makes the boundaries between agents and protocols a security issue in their own right, not merely a prompt-writing concern.

For operators, the report’s most useful point is also the least glamorous: validate destinations, limit what each agent can access, and require authorisation before sensitive actions. The underlying bugs Ars discusses, including server-side request forgery, are familiar security problems. Connecting them to agent workflows makes them newly easy to overlook.

Our read

The reported Google fix is a concrete reminder that an agent’s confidence in another agent is not a security control. Treat content passed through models and tools as untrusted, and make access checks at the point where a sensitive request is made. The report makes a serious case for scrutiny of agent-to-agent systems, while leaving the full prevalence of these weaknesses unclear.

What to watch

• Whether other MCP servers add destination validation and tighter access controls.
• Whether organisations publish details of fixes and exposure in deployed agent systems.
• Whether standards for agent hand-offs make authorisation explicit across protocols.

Discussion spark: Should organisations treat every request passed between AI agents as untrusted by default, even if that adds friction to automated workflows?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.