More AI systems now pass work from one agent to another. New research suggests those handoffs may be where security breaks down.

Independent security researcher Syed Anas Mohiuddin built proof-of-concept attacks that exploit weak trust boundaries in the Model Context Protocol (MCP), according to Ars Technica. MCP is the open standard many AI systems use to reach tools, data and outside services. He says he tested agent systems connected to Google, JPMorgan Chase, Weaviate, Rapid7, France's interministerial digital directorate and the U.S. federal government. The Next Web reports that Google, JPMorgan Chase, Weaviate and France's digital directorate have since shipped fixes, while five U.S. federal servers were still unpatched as of this week. Neither outlet reports the flaw being exploited in the wild.

Syed calls the technique "protocol pivoting." It starts when an application assigns a task to an agent over MCP. That agent then relays tainted instructions to a second agent through a different channel, such as Google's Agent-to-Agent (A2A) protocol. Along the way, the record of who approved the request, and what they were allowed to do, gets lost. The second agent treats the instruction as legitimate and acts on it. Another researcher in the piece described the method as a variant of indirect prompt injection. That researcher added that the attack doesn't strictly require crossing protocols.

Part of the problem is built into the standard. Syed has also written an individual IETF Internet-Draft, an informational submission rather than an IETF standard or endorsement. It notes that the MCP specification sets no mandatory security requirements, which leaves those choices to whoever builds and operates a deployment. The draft also points out that tool-call parameters are produced by model reasoning, which prompt injection can steer.

Independent guidance points the same way. A June 2026 NSA security-design document on MCP flags implicit trust between components, weak links between identity and sessions, and missing access controls. It urges organizations to draw clear trust boundaries between agents, tools, models and users.

The answer isn't to abandon connected agents. It's to stop treating internal handoffs as safe by default:

The bigger lesson is that in a multi-agent system, an instruction carries authority as well as information. Every handoff is a chance for someone who never had that authority to borrow it.