The finding
Security researcher Syed Anas Mohiuddin documented recurring MCP implementation weaknesses across systems maintained by organizations including Google, JPMorgan Chase, Weaviate, France's DINUM and Tangerang City. The underlying findings include server-side request forgery patterns, while the broader protocol-pivoting model describes malicious influence entering one protocol layer, invoking an MCP tool, crossing into agent-to-agent delegation and reaching additional services under inherited trust.
The authority problem
Agent systems can mistake trusted communication for valid delegation. An instruction that enters through untrusted content does not become authoritative because a trusted internal agent relays it through MCP, A2A or another protocol.
Protocol transition does not create authority. Agent-to-agent trust is not enterprise delegation.
The authority-layer answer
Cross-agent transitions should preserve or independently resolve the originating principal, mandate, delegation, instruction provenance, information boundary, target, proposed effect and current authority state. If required authority provenance disappears during a protocol transition, the safe outcome is hold or deny rather than inferred trust.
GitHub implication
A GitHub coding agent may call an MCP server, delegate to a remediation agent or hand work to a deployment agent. The downstream agent must not inherit production, cloud or deployment authority simply because the request originated from a trusted GitHub agent.
Why this matters
Multi-agent architectures multiply trust boundaries. Enterprise authority has to remain continuous across those boundaries instead of being reconstructed from whichever agent or protocol happens to be speaking next.
Sources
https://thenextweb.com/news/mcp-flaw-ssrf-google-jpmorgan-dinum-protocol-pivoting
https://datatracker.ietf.org/doc/html/draft-mohiuddin-mcp-security-considerations-00
NEXT STEP