"We trust each other's work."

The vulnerability isn't the protocol itself but the deployment pattern it enables. MCP (Model Context Protocol) allows AI agents to communicate with each other and share information — useful enough on its surface. But the actual danger isn't malicious prompts spreading between agents. It is that enterprises are deploying multiple specialized agents that trust each other's outputs by default with no human verification layer in between, a architecture every major AI vendor is now selling as efficiency.

Consider how this looks in practice. A procurement bot requests a purchase from an approval bot. The approval bot trusts that request came from where it says it came from and approves automatically. The approval triggers a payment bot, which executes the transaction. Each agent assumes the previous agent has done its job honestly. Each assumption is baked into the system design, not tested against reality.

The MCP protocol creates trust gaps — places where one agent communicates with another without cryptographic verification of integrity or origin. A malicious actor who compromises the procurement bot can inject false requests that look legitimate to the approval bot. The approval bot has no mechanism to catch the deception because it was never designed with skepticism. It was designed to be fast.

This is not theoretical. Enterprises are already shipping these multi-agent architectures. JPMorgan's document processing systems, for instance, use agent networks that handle loan approvals and compliance checks. No published vulnerabilities in MCP have triggered major incidents yet. The deployment pattern is moving faster than the security hardening. A single compromised agent in a high-stakes workflow. Payroll approvals, procurement thresholds, financial releases. Can execute decisions worth millions in the time it takes a human oversight team to notice something is wrong. By then, the damage compounds.

The MCP problem reveals something older about institutional risk. Organizations don't adopt security practices because they are theoretically sound. They adopt them when they have already been burned. We will see the first major breach in an agent network within the next eighteen months. It will be expensive enough that enterprises finally demand verification layers they should have demanded from day one. Until then, the protocol ships as advertised. The people building these systems are rationalizing the speed as worth the risk.