数百万组织对人工智能智能体的采用，正在为攻击者创造新的机会，让他们能够诱导智能体采取恶意行为，例如窃取数据库内容以及敏感的业务和个人信息。
The adoption of AI agents in millions of organizations is creating new opportunities for attackers to make them take malicious actions, such as exfiltrating database contents and sensitive business and personal information.
在过去的五个月里，谷歌和其他四个组织（它们之间除了使用人工智能智能体之外几乎没有什么共同点）承认了漏洞：这些漏洞利用目标网络内部的一个智能体，将有害指令传播给其他内部智能体。这种技术是一种特殊形式的提示词注入，其目标不是大语言模型（LLM），而是某个特定的智能体，例如用于翻译或数据分析的智能体。这类智能体内部的防护栏（如果存在的话）通常比较松懈，会将指令发送给下游的其他智能体。由于后一个智能体明确信任第一个智能体，因此它会执行这些指令。
In the past five months, Google and four other organizations—with little in common except for their use of AI agents—have acknowledged vulnerabilities that exploit one agent inside a targeted network to spread harmful instructions to other internal agents. The technique is a special form of prompt injection that targets not the LLM but a particular agent, such as one for translation or data analysis. Guardrails inside such agents, if they exist at all, are often lax and will send the instructions to other agents down the chain. Because the latter agent explicitly trusts the first one, it follows the directions.
独立研究员赛义德·阿纳斯·莫希乌丁（Syed Anas Mohiuddin）测试了包括谷歌、摩根大通、Weviate、Rapid7、法国政府跨部会数字总局以及美国联邦政府等组织的智能体。他的概念验证攻击利用了 MCP（模型上下文协议，Model Context Protocol）中的信任鸿沟。该标准是人工智能应用和智能体在内部网络中相互通信的方式之一。下图展示了简化版 MCP 的运行机制。
Independent researcher Syed Anas Mohiuddin tested agents from organizations including Google, JP Morgan Chase, Weviate, Rapid7, the French government's interministerial digital directorate, and the US federal government. His proof-of-concept attacks exploit trust gaps in MCP, short for Model Context Protocol. The standard is one way AI apps and agents communicate with each other inside an internal network. The illustration below shows a simplified MCP in action.