Agent-to-Agent Worm Propagation in MCP-Based AI Systems

Abstract

MCP-connected agents often read from and write to shared systems such as Slack, GitHub, Jira, email, and Notion. Most prompt-injection research focuses on a single agent, but this work asks a different question: can attacker-controlled context move from one agent to another and trigger actions with the second agent’s permissions?

We present a two-hop propagation model. First, Agent A reads a poisoned MCP tool description and writes a carrier into a shared channel. Later, Agent B reads that content as part of its normal workflow and may perform unintended actions using its own tools. We count propagation only when Agent B performs an unintended tool call; simply reading the payload is not considered a successful chain.

Using MCParasite in controlled and sandboxed environments, we reproduced end-to-end propagation in 21 of 26 channel tests. Every tested shared channel propagated at least once, although outcomes varied across models and context configurations. The poster explains how this propagation works, what we measured, and where defenders can break the chain through context separation, provenance tracking, least privilege, sensitive-action approval, and complete tool-call logging.