Google, Rapid7 and three other organizations acknowledged flaws that pass injected prompts between agents

What happened

Independent researcher Syed Anas Mohiuddin showed that a prompt planted in one internal agent can be handed to other agents over MCP or Google's Agent-to-Agent (A2A) protocol and carried out because the receiving agent trusts the sender, a technique he calls protocol pivoting. Ars Technica reported that Google and four other organizations acknowledged the flaws, with Google fixing a server-side request forgery (SSRF) bug rated 8 out of 10 in its MCP Toolbox for Databases and Rapid7 fixing one rated 2.7.

Why it matters

The bugs underneath were ordinary injection and SSRF. What was new is the route: each protocol checked its own entry point and nothing checked the hand-off between agents. It is the same failed boundary as the Google ADK chain in August, and the fix is the same too, authorizing delegated tasks as if they came from outside.

Sources

1. Ars Technica MCP for agent-to-agent comms may be the riskiest protocol you've never heard of October 7, 2026