Prompt injection over MCP enables 'protocol pivoting' between AI agents; Rapid7 responds with A2A security guidance

Researcher Syed Anas Mohiuddin demonstrated prompt-injection pivoting attacks over the Model Context Protocol against agents at Google, JPMorgan Chase, Rapid7, Weviate, and government bodies, prompting fixes and a Rapid7 call for identity and least-privilege…

On October 5, 2026, Ars Technica reported that researcher Syed Anas Mohiuddin had shown proof-of-concept 'protocol pivoting' attacks in which malicious instructions injected over the Model Context Protocol (MCP) are accepted by weakly guarded agents and forwarded to trusted agents, often resulting in server-side request forgery. Targets included AI agents at Google, JPMorgan Chase, Rapid7, Weviate, France's interministerial digital directorate, and the US federal government. Rapid7's CVE-2026-97228, scored 2.7, was patched; Google's mcp-toolbox flaw, rated 8, followed redirects without validating target IP addresses until an allow-list fix was deployed. X41 D-Sec researcher Markus Vervier characterized the technique as indirect prompt injection. Rapid7 advises treating LLM-to-tool content as untrusted input. The following day, October 6, 2026, Rapid7 published guidance arguing that autonomous agents delegating work via protocols such as MCP break security models built for human users and static APIs. It cited identity and delegation chaining blind spots, behavioral drift that can hide prompt injection, tool abuse leading to data exfiltration, cascading access from a compromised high-privilege agent, and gaps in reconstructing multi-agent decisions. Rapid7 recommends auditing agents, least-privilege task-scoped credentials, structured inter-agent logs and telemetry, and feeding agent events into detection workflows, including its own platform.

• Researcher Syed Anas Mohiuddin reported proof-of-concept 'protocol pivoting' attacks against AI agents at Google, JPMorgan Chase, Rapid7, Weviate, France's interministerial digital directorate, and the US federal government.
• CVE-2026-97228 (Rapid7) was scored 2.7 and has been patched.
• Google's mcp-toolbox flaw was rated 8; it followed redirects without validating target IPs until an allow-list fix.
• Malicious prompts can cross from MCP into A2A or other agent protocols, frequently causing server-side request forgery (SSRF).
• X41 D-Sec researcher Markus Vervier describes the technique as indirect prompt injection.
• Rapid7 says LLM-to-tool content should be treated as untrusted input.
• Rapid7's October 6 guidance cites identity/delegation chaining gaps, behavioral drift masking prompt injection, tool abuse enabling data exfiltration, cascading access from compromised high-privilege agents, and poor reconstructability of…
• Rapid7 recommends agent audits, least-privilege task-scoped credentials, structured inter-agent telemetry and logs, behavioral baselines to flag unusual communication or privilege changes, and routing agent events into detection workflows.