Ars Technica Warns of “Protocol Pivoting” Risks in MCP Workflows

MCP protocol pivoting is a term Ars Technica used in an analysis of research into the transfer of malicious instructions between AI agents and protocols. The issue is not one universal vulnerability in the Model Context Protocol (MCP) standard, but recurring errors in implementing trust boundaries: an agent may forward untrusted input to another system, which then processes it with its own privileges.

Such a chain can lead, for example, to SSRF or indirect prompt injection. The risk primarily affects organizations that give agents access to internal networks, APIs, databases, or tools capable of performing writes and other sensitive operations.

MCP Protocol Pivoting and Trust Boundaries

MCP is an open standard primarily designed to connect AI applications to external data, tools, and workflows. It is not, in itself, a general protocol for agent-to-agent communication. However, linking multiple components can create a path through which content from an untrusted source becomes a request executed with the privileges of an agent or tool.

Ars Technica refers to this pattern as “protocol pivoting.” It involves transferring malicious instructions across components that have different assumptions about the trustworthiness of inputs. However, another security researcher cited by the outlet considers the term more of a subclass of indirect prompt injection than a separate established vulnerability category.

In May 2026, the NSA warned that MCP deployments require careful implementation because of risks associated with trust boundaries, agent abuse, and dynamic tool calls. Similarly, Google Cloud documentation lists prompt injection and dangerous tool chaining among the risks of autonomous agents using MCP.

Confirmed Bulk Export MCP Flaw Has Been Fixed

Rapid7 tracks one specific confirmed case as CVE-2026-97228. The vulnerability affects Bulk Export MCP versions 0.2.5 through 0.6.1 and consists of GraphQL injection. A fix is available in version 0.6.2.

Rapid7 rates the flaw at a CVSS score of 2.7. According to Rapid7, the vulnerability does not allow an attacker to exceed the operator’s existing privileges. This case therefore should not be confused with evidence of widespread compromise of MCP environments or with confirmation of active exploitation in real-world attacks.

The Ars Technica report mentions additional cases at various organizations, including Google and JPMorgan Chase. However, the available materials did not provide separate first-party confirmation for all of these cases. It therefore cannot yet be claimed that the identical problem was independently confirmed and fixed at exactly five organizations.

What MCP Deployment Administrators Should Check

Google Cloud recommends least privilege, isolation, and filtering of both inputs and outputs. In practice, it is important not to automatically treat data passed through an agent chain as trusted simply because it came from another internal component.

• Update Bulk Export MCP to at least version 0.6.2, if deployed.
• Validate destination URLs and IP addresses for tools that access network resources.
• Block unwanted redirects and restrict agents’ access to internal addresses.
• Use separate identities and permissions for individual agents and tools.
• Require explicit approval before risky actions, especially writes, exports, or network calls.

Further developments will show whether first-party advisories emerge for additional cases mentioned in the report, particularly Google MCP Toolbox for Databases. It will also be important to see whether vendors or CISA confirm real-world exploitation and whether MCP implementations introduce better transmission of identity, authorization, and data provenance between components.

Verified and updated: 10/06/2026 06:27