AI agents can relay malicious instructions across chained components, bypassing built-in safeguards and potentially reaching internal organizational resources. The approach relies on the fact that trust and authorization checks often disappear when tasks are handed off between different protocols and specialized agents.
Researcher Syed Anas Mohiuddin described the technique as protocol pivoting. He examined systems using the MCP protocol, which connects AI agents to tools and data sources. When a task moves from one component to another, verification steps are frequently lost, allowing a planted instruction to reach an agent responsible for translation or data analysis.
Once accepted as a legitimate request, the malicious payload can trigger unwanted network connections or data disclosure. In Google MCP Toolbox for Databases, Mohiuddin showed that an attacker could force the HTTP client to follow a redirect to an internal address. Google later added address validation and limited permitted request destinations in a patch.
A related finding, CVE-2026-97228, affected Rapid7 Bulk Export MCP. The vulnerability carried a CVSS score of only 2.7 because an unchecked argument allowed modification of a GraphQL query structure. Rapid7 addressed the issue in version 0.6.2 and confirmed that queries remained limited to the permissions of the original API key owner.
Security researcher Markus Vervier of X41 D-Sec observed that the reported behavior is a variant of indirect prompt injection rather than a fundamentally new attack method.
