Brief · Builders
Your agents trust each other. Attackers noticed.
Ars Technica reports that independent researcher Syed Anas Mohiuddin found the same weakness in agent setups at Google, JP Morgan Chase, Rapid7 and others. Plant text in some content. One agent reads it and hands it to another agent as a normal delegated task. The second agent runs it because it trusts whoever handed it the work. He calls it "protocol pivoting." Others call it indirect prompt injection. Either way, the payoff is often plain old SSRF.
Google's bug, in googleapis/mcp-toolbox, was rated 8.0 out of 10 (High, CVE-2026-14540): the HTTP client had no CheckRedirect policy and didn't validate target IP addresses. Rapid7's, CVE-2026-97228, was rated 2.7 out of 10.
None of this is new. It's injection and SSRF in an agent costume. Rapid7's Douglas McKee said it best: anything passed from an LLM to your tool should be treated "like input from a stranger on the Internet."
What to do: Validate every URL and redirect your tools fetch, block private and internal addresses at egress, and make agents authorize each other before sensitive actions.