One protocol handed the instructions to another

Ars Technica reported on 5 October 2026 that independent researcher Syed Anas Mohiuddin found the same shape of attack at Google, JPMorgan Chase, Weaviate, the French government's interministerial digital directorate (DINUM) and the Tangerang City government in Indonesia — each confirmed by the organization's own security team — while Rapid7 published a CVE for a different but related bug, and reports against five US federal government MCP servers remain unconfirmed in triage. He calls it protocol pivoting: an application or server uses the Model Context Protocol (MCP) to assign a task to an agent, and that agent forwards malicious instructions to a more privileged internal agent over a different channel, such as Google's Agent-to-Agent (A2A) protocol or the emerging Agent Network Protocol. The attack does not target the language model the way a conventional injection would; it targets the specific agent, such as one for translation or data analysis, whose guardrails, if they exist at all, are often lax enough to pass the instructions along. The next agent in the chain follows them because it trusts the one that handed them over.

The trust gap is structural rather than incidental. MCP servers store credentials for each agent, and agents are built to trust every other internal agent, so an exploit the model itself would have rejected can still succeed once it arrives from a trusted peer. In many cases, Ars reported, a well-crafted prompt aimed at the right agent leads to server-side request forgery, where a web server is made to issue unauthorized network requests. Rapid7's exposure was tracked as CVE-2026-97228, rated 2.7 out of 10 and fixed by the company last month. Google's was rated 8.0, and stemmed from an MCP toolbox for databases (googleapis/mcp-toolbox) initializing its HTTP client without a CheckRedirect policy, the settings that govern how a server handles an error or a redirect, and without validating target IP addresses. As Mohiuddin described it, a crafted path parameter could make the toolbox follow a redirect to an internal endpoint and send requests on the attacker's behalf.

Douglas McKee, director of vulnerability intelligence at Rapid7, told Ars that every link in such a chain behaves exactly as designed, which is what makes it hard to catch. "Someone plants text in content, an agent will read it then pass it along to another agent as a normal delegated task, and that second agent runs it because it trusts whoever handed it the work," he said. "Each protocol was built assuming it lived on its own, so each one checks its own front door while nobody watches the hallway in between." The underlying bugs, he added, are old friends like injection and SSRF whose fixes have not changed in twenty years; the researcher's contribution, in his view, is putting a name on the class, because a name is what gets defenders and standards bodies to design for it.

Ars framed the episode against the rush to build sprawling agentic architectures, arguing that organizations have abandoned a core security principle, zero trust, under which a network is built assuming one or more nodes may already be compromised and nodes must require authorization before sensitive transactions with one another. McKee's summary of the lesson: anything passed from a model to a tool should be treated like input from a stranger on the internet, because in a prompt-injection scenario that is exactly what it is.

Google's fix involved applying an allow-list of IP ranges and block lists, and rejecting an unsafe base URL at startup rather than on first request. "That is what a real SSRF guard looks like," Mohiuddin wrote. "It is also more work than most MCP servers have done."

Markus Vervier, a researcher at X41 D-Sec who has published MCP-related attack research of his own, disputed the new label. "For me this is indirect prompt injection," he told Ars. "The fact that the malicious prompt can come from a different protocol (e.g., A2A) and manifests when used over another protocol is not strictly required for such attacks to work. It is, of course, unexpected and hard to mitigate in general." A rebuttal essay, "The Relayer Is Not the Author," published on 6 October, engaged the disagreement directly.

The Ars article is the primary account; Mohiuddin's own portfolio write-up and Rapid7's vulnerability record are the corroborating sources. The vulnerabilities were disclosed and, in the cases described, fixed, rather than being observed in the wild.