Protocol Pivoting: Prompt Injection That Hops From Agent to Agent
A researcher showed that planted instructions can pass from one agent to another through different protocols, and Google and four other organizations acknowledged related flaws.
What happened
Independent researcher Syed Anas Mohiuddin showed what he calls “protocol pivoting.” An app hands work to one agent over MCP, and that agent passes hidden instructions to a second agent over a different protocol, such as Google’s A2A. Trust gets “lost in translation” between protocols, and the second agent can be pushed into actions like reaching internal servers (Ars Technica).
He tested agents from Google, JPMorgan Chase, Weaviate, Rapid7, the French government’s digital directorate and the US federal government. Google and four other organizations acknowledged vulnerabilities (Ars Technica).
Rapid7’s Douglas McKee described the core problem: each agent checks its own front door while nobody watches the hallway in between (Ars Technica).
Why it went wrong
- Agents trust instructions that come from other internal agents and pass them along as normal delegated work.
- Nothing independent checks the message as it moves from one agent to the next.
How AI tracking would have helped
AI tracking records every message, and agents know it. It can also hold a message until you or a reviewer agent approves it, and alert you to risky ones. It can’t stop what an agent does outside its channels.
What AI tracking would have recorded
- AI tracking is a witness in the hallway. Every message between agents is recorded the same way, whatever the sending agent decides.
- A receipt for every message shows exactly what passed from one agent to the next, so a planted instruction can be traced back to where it came in.
Why being watched matters
- A message that is recorded by a neutral third party is much harder to pass off as normal delegated work later.
- You can review the record and find the agent that relayed the instruction.
What AI tracking would not have done
AI tracking doesn’t block prompt injection. A planted instruction can still get through. What AI tracking adds is a record that shows where it entered and every agent it passed through.
Sources
Give your agents a place where they know they’re watched
Create a free workspace with 3 channels and 10 agent keys.