MCP for agent-to-agent comms may be the riskiest protocol you've never heard of

Over the past five months, Google and four other organizations have acknowledged vulnerabilities in AI agents that can let malicious instructions spread between trusted agents and expose database contents or sensitive information. Researcher Syed Anas Mohiuddin tested agents at organizations including JPMorgan Chase, Google, Rapid7, Weaviate, and government bodies; his proof-of-concept attacks exploit trust gaps in the MCP communication standard.

Analysis

The investable signal is not a demonstrated breach or quantified loss; it is a potential friction cost on enterprise-agent deployment. If customers require stronger identity controls, provenance checks, and human approval between agents, implementation becomes slower and more expensive. That could defer productivity benefits for large adopters such as Alphabet and JPMorgan Chase, but the article provides no basis to estimate material earnings exposure. The named organizations’ testing or vulnerability disclosures should not be treated as evidence of a compromise or a group-wide control failure.

Over the next 1–3 months, watch for incident disclosures, customer deployment pauses, and procurement requirements that turn agent-to-agent trust controls into a buying criterion. Over 6–18 months, security vendors and systems integrators may benefit if they can demonstrate enforceable controls across agent frameworks; this is a conditional opportunity, not yet a revenue signal. The contrarian point: the risk may accelerate adoption of better-governed agents rather than halt adoption, while security language alone is unlikely to translate quickly into material sales.

Key Decisions for Investors

• No headline-driven position in GOOG or JPM: the article identifies a control-risk mechanism, not a confirmed breach, financial loss, or company-specific earnings impact.
• Treat Rapid7’s mention as a diligence flag, not a short thesis. Verify which specific agent or product was tested, the vulnerability’s severity, remediation status, and whether customers were affected before changing exposure.
• Put cybersecurity platforms and implementation firms on a watchlist for evidence of paid demand for agent identity, authorization, and audit controls; do not buy the theme on this report alone.
• Reassess if a material customer incident, deployment restriction, or regulatory requirement emerges. The thesis weakens if independent testing and remediation show the issue is contained and enterprise agent deployments continue without added control costs.