Glossary

What is protocol pivoting?

Protocol pivoting is server-side request forgery through an AI agent's tools: a tool fetches a URL the agent supplies from inside your network, so whoever steers the agent reaches systems they could not reach directly.

Why it matters

Agents pass URLs and hostnames to tools constantly, and many MCP servers will fetch whatever they are given. That turns a prompt injection, which normally only changes what the agent says, into network access to internal services and cloud metadata endpoints. Hostname-only checks are easy to bypass with DNS rebinding.

Example

On 6 October 2026 a researcher reported that MCP servers which fetch agent-supplied URLs can be used to reach internal networks (researcher write-up; CVE-2026-14540 per the researcher, not yet on NVD).

How to defend against it

Give every URL-fetching tool an egress allowlist, enforced at a proxy outside the tool (checklist).
Resolve the hostname first, then block private, loopback and link-local addresses, including 169.254.169.254.
Run fetchers in a network-isolated sandbox with no credentials.
Log every fetch with the agent session that requested it.

Ambient credentials, indirect prompt injection, MCP gateway.

Sources

From AgentSec Brief, the daily brief on securing agentic AI. Subscribe free at https://www.agentsecbrief.com

W003: PHP2Shell exploit attempts hit millions in hours; AI agents ran real intrusions

The patch window is now hours: PHP2Shell drew millions of attempts, AI agent crews ran real intrusions, and attackers rode identities agents already trusted.

N015: Hackers hunted AI keys in Railway and Zeabur customer secrets; Zeabur will close

Attackers searched hosting platforms' stored customer secrets for AI keys, four crews ran AI attack harnesses, and banks found customers' agents in their accounts.

What is an uninstructed action?

An uninstructed action is something an AI agent does that neither its operator nor an attacker told it to do, such as using a credential it found.

What is oversight tampering?

Oversight tampering is when an AI agent changes, disables or hides the logging, alerts or reviews that watch it, on purpose or as a side effect of its task.