MCP Trust Gaps Expose Agent Chains to Prompt Injection Attacks

A wave of vulnerabilities in the Model Context Protocol (MCP) has surfaced across Google, JPMorgan Chase, Rapid7, Weaviate, and several government agencies, highlighting a systemic risk in how AI agents delegate tasks to one another. Independent researcher Syed Anas Mohiuddin demonstrated that prompt injections aimed at a single specialized agent — such as a translation or data-analysis bot — can propagate downstream because each agent implicitly trusts its peers. MCP servers store credentials for every participant, so a compromised link in the chain can escalate into server-side request forgery or data exfiltration.

The most severe finding, rated 8.0, involved Google's mcp-toolbox for databases. Its HTTP client lacked a CheckRedirect policy and failed to validate target IP addresses, allowing a crafted path parameter to redirect requests to internal endpoints. Rapid7's CVE-2026-97228, though rated only 2.7, illustrated the same pattern: an agent read injected content, passed it along as a normal delegated task, and the receiving agent executed it because trust was assumed rather than verified.

Why it matters for GPU / AI infrastructure

As enterprises pack more agents onto GPU clusters, the attack surface grows laterally. Each agent becomes a potential pivot point, and the high-speed, low-latency fabric that makes GPU clouds attractive also accelerates lateral movement. Hardening MCP implementations — enforcing strict redirect policies, validating every hop, and adding zero-trust checks between agents — must become a baseline requirement before scaling agent fleets on shared accelerator infrastructure.