Flaws in automated helper networks let bad instructions hop between workplace systems

Countless workplaces have started using connected software agents to handle business tasks. These digital tools talk to each other across private corporate networks to examine data, rewrite files, or handle company records.

A researcher named Syed Anas Mohiuddin has revealed that this mutual cooperation creates serious weaknesses. By fooling one helper, an outsider can quietly pass harmful instructions to a different tool deeper inside the business.

The root of the trouble sits in a rising communication system called the Model Context Protocol, or MCP. Organizations rely on MCP to let independent tools swap messages and share internal credentials.

Because these digital helpers assume all teammates are friendly, they do not check work sent from another internal service. A single bad command sent to a simple task tool can therefore reach an advanced tool that would normally block outsiders.

Five major groups have acknowledged similar flaws in recent months, including Google, Rapid7, Weviate, JPMorgan Chase, and government offices in both France and the United States. None of these groups share infrastructure, but all ran automated helpers using MCP.

The issue often triggers a server-side request forgery, which occurs when a web server gets tricked into issuing unintended commands across a private network. In worst-case scenarios, this lets intruders steal database files or private corporate records.

At Google, an MCP tool designed for databases showed a serious weakness scored at an eight out of ten. The tool failed to check internet addresses and followed web redirects without caution, letting crafted commands query protected private endpoints.

Google repaired its database tool by setting clear lists of allowed internet address ranges and blocking dangerous links as soon as the service boots up.

At the security firm Rapid7, Mohiuddin discovered a milder bug labeled CVE-2026-97228, which carried a 2.7 severity score. Rapid7 addressed and patched that specific hole in September.

Douglas McKee of Rapid7 explained that each individual protocol behaves normally on its own. The danger appears because no system monitors the space between tools, allowing delegating helpers to relay poisoned work without scrutiny.

Mohiuddin described this method as protocol pivoting. An attacker enters through one standard, relies on the blind trust between programs, and leaps to separate channels such as Google's Agent-to-Agent protocol to grab sensitive privileges.

Other security specialists, such as Markus Vervier from X41 D-Sec, see this simply as an indirect prompt injection. Regardless of the label, Vervier noted that stopping bad instructions from jumping across communication rules remains difficult.

Experts say many teams forgot the basic rule of zero trust when setting up their automated helpers. That security approach demands that every machine continually verify its peers, treating any data handed down by an automated helper like text from a stranger.