One AI agent can pass a malicious prompt to another

Ars Technica reports that MCP, which is also used for communication between agents, may be one of the riskiest protocols most people have never heard of. Trust gaps in it let a malicious prompt spread from one agent to another. The trigger was a vulnerability in agents from Google and others, which exposed a structural flaw in the protocol.

When agents exchange messages, each has to trust its counterpart to some degree, so a harmful instruction can travel further down the chain. The flaw is described as structural, meaning the problem lies in how the protocol is built rather than in a single product's bug.

Map which agents and tools in your company talk to each other, and what each is allowed to do: read data, make payments, send messages. Damage is easier to contain when access follows job roles: in 1Cifer every employee's agent sees only the data its position allows. Be especially careful when connecting third-party agents.