AI agents' trust in each other creates security vulnerability across networks

Organizations deploying AI agents across their networks face a fresh class of attack: adversaries can compromise a single agent and use it to send malicious commands to other trusted agents in the same system, potentially exposing databases and sensitive data.

Over the past five months, security researchers have identified vulnerabilities in agent systems built by Google, JP Morgan Chase, Weaviate, Rapid7, the French government's digital ministry, and US federal agencies—a diverse group united only by their reliance on AI agents for internal operations.

How the attack works#

The vulnerability exploits a fundamental design principle in how modern AI agents interact with one another. Attackers craft specially engineered prompts that target an individual agent (one handling translation, data analysis, or similar tasks) rather than the underlying language model directly. This is a specialized variant of prompt injection—a technique where malicious text tricks AI systems into executing unintended actions.

The key weakness: many purpose-built agents have minimal or nonexistent safeguards, and crucially, they implicitly trust other agents on their network. When a compromised agent receives a malicious prompt, it will pass those instructions downstream to other agents, which obey them without question because they come from an apparently trusted peer.

The role of MCP#

The attacks center on vulnerabilities in the Model Context Protocol (MCP), a standard that enables AI applications and agents to communicate within corporate networks. MCP servers maintain credentials for each agent, further amplifying the risk: once one agent is compromised, the attacker gains access to a chain of authenticated connections.

Researcher Syed Anas Mohiuddin demonstrated that carefully crafted prompts targeting the right agent can trigger server-side request forgery attacks—a vulnerability that tricks web servers into making unauthorized network calls to internal systems they shouldn't be accessing.

Why mitigation is difficult#

Traditional guardrails that limit what language models can do offer little protection here, since the attack bypasses the LLM entirely by exploiting the trust relationship between agents. Organizations running these systems lack straightforward defenses, creating a structural problem that requires rethinking how agents are configured to interact.