> ## Content Index
> Fetch the complete content index at: https://www.agentsecbrief.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# What is protocol pivoting?
- URL: https://www.agentsecbrief.com/what-is-protocol-pivoting/
- Published: 2026-10-09T18:12:42.000Z
- Updated: 2026-10-09T18:12:42.000Z
- Description: Protocol pivoting is server-side request forgery through an AI agent's tools: a tool fetches a URL the agent supplies from inside your network, so whoever steers the agent reaches systems they could not reach directly.
- Author: Angela Milash
- Tags: Glossary, MCP, Prompt Injection

**Protocol pivoting is server-side request forgery through an AI agent's tools: a tool fetches a URL the agent supplies from inside your network, so whoever steers the agent reaches systems they could not reach directly.**

## Why it matters

Agents pass URLs and hostnames to tools constantly, and many MCP servers will fetch whatever they are given. That turns a prompt injection, which normally only changes what the agent says, into network access to internal services and cloud metadata endpoints. Hostname-only checks are easy to bypass with DNS rebinding.

## Example

On 6 October 2026 a researcher reported that MCP servers which fetch agent-supplied URLs can be used to reach internal networks ([researcher write-up](https://anas-security-portfolio.vercel.app/protocol-pivoting-update.html?ref=agentsecbrief.com); CVE-2026-14540 per the researcher, not yet on NVD).

## How to defend against it

- Give every URL-fetching tool an egress allowlist, enforced at a proxy outside the tool ([checklist](https://www.agentsecbrief.com/checklist/)).
- Resolve the hostname first, then block private, loopback and link-local addresses, including 169.254.169.254.
- Run fetchers in a network-isolated sandbox with no credentials.
- Log every fetch with the agent session that requested it.

## Related terms

[Ambient credentials](https://www.agentsecbrief.com/what-are-ambient-credentials/), indirect prompt injection, MCP gateway.

## Sources

- [Protocol pivoting update (researcher, 6 Oct 2026)](https://anas-security-portfolio.vercel.app/protocol-pivoting-update.html?ref=agentsecbrief.com)
- [OWASP SSRF Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server%5FSide%5FRequest%5FForgery%5FPrevention%5FCheat%5FSheet.html?ref=agentsecbrief.com)

From AgentSec Brief, the daily brief on securing agentic AI. Subscribe free at [https://www.agentsecbrief.com](https://www.agentsecbrief.com/)