A structural flaw in MCP lets malicious prompts spread between AI agents

MCP, the Model Context Protocol increasingly used to let AI agents communicate with one another, may be one of the riskiest protocols that most practitioners have never heard of. That is the warning from Ars Technica.

The problem

The core concern lies in trust gaps built into the design of the protocol itself. When one agent calls another, there is no reliable boundary separating harmless service data from malicious instructions. As a result, a malicious prompt that reaches one agent can spread further and be passed along to the next participant in the chain.

According to the report, this is not a one-off bug in a single implementation but a structural flaw: the vulnerability was found in agents from Google and others, pointing to a systemic weakness in the architecture of agent-to-agent exchange.

Why it matters

As AI agents are handed more autonomous tasks and wired into chains where one agent invokes another, the risk multiplies. Malicious text injected once into the flow can move between components as freely as legitimate data, all while retaining the force of a command. That turns the familiar prompt-injection attack into a problem that propagates across an entire agent infrastructure.

The arrival of a convenient standard for agents to talk among themselves accelerates the development of autonomous systems — but, as Ars Technica stresses, the convenience comes with new classes of threats the industry is only beginning to grasp.

Source: Ars Technica