Google's agent trust model hands strangers the keys

A structural flaw in how agents share work across Model Context Protocol, the messaging standard many agent systems use, lets a rogue agent impersonate a trusted one. Google and other major vendors are affected. No single vendor can fix it alone because the flaw lives in the shared protocol, not in one product. The problem is straightforward. One agent hands a job to another. The receiving agent has no reliable way to confirm who sent it. A hostile agent can claim to be a colleague, inherit its access rights, and act on its behalf. The human who approved the original job does not see the substitution happen. For teams building agent products, this reshapes what approval and access decisions mean. A human can approve an agent and grant it standing access, then a second agent, one the human has not seen, can do the work. The human's decision covers less than they think it does. Teams need to design for that gap now, before protocols catch up.