The Inter-Agent Contagion: Why MCP Exposes the Fragility of Multi-Agent Systems

As the software industry rushes to transition from standalone large language models to collaborative swarms of autonomous agents, an uncomfortable truth continues to haunt the architecture: we still have not solved prompt injection. When systems rely on natural language as both the execution code and data layer, connecting multiple agents together does not create synergy. It creates an infection vector.

Recent analyses surrounding the Model Context Protocol (MCP) highlight structural vulnerabilities in how agent-to-agent communication is being standardized. Originally designed to streamline context sharing, data retrieval, and tooling integrations between models, the protocol inadvertently establishes trust boundaries that simply do not exist in practice. When an upstream agent ingests untrusted text and transforms it into structured instructions for a downstream agent, any adversarial payload embedded in the original input can jump across the system boundary with zero cryptographic or semantic resistance.

This vulnerability lays bare the persistent hubris of current multi-agent engineering. In traditional distributed systems, software engineers rely on typed schemas, input sanitization, and strict privilege separation. In the AI agent paradigm, however, developers treat semantic comprehension as a substitute for validation. A secondary agent trusts a primary agent not because the payload is mathematically verifiable, but because it assumes the generating model has already "understood" and filtered malice. This assumption is fundamentally broken.

Indirect prompt injection remains an open, unsolved alignment challenge. When agents are chained via protocols like MCP, an injection attack transforms from a single-turn jailbreak into a distributed cascade. An unvetted prompt on a public web page can manipulate a web-browsing agent, which subsequently passes an adversarial context payload through an MCP link to an internal code-execution or enterprise-access agent. The resulting breach requires no software zero-day; it merely exploits the probabilistic gullibility inherent to transformer models.

Until the AI community confronts the reality that language models cannot reliably demarcate data from code, standardized communication protocols will remain amplifiers of architectural risk. The solution is not to slap superficial safety filters onto downstream agents, nor is it to declare the protocol secure by convention. Building robust multi-agent systems demands verifiable isolation and least-privilege paradigms that assume every agent in the network is already compromised.

Photo: MARCO / Unsplash (https://unsplash.com/@thephotoandfocus)