Five organizations, including Google, recently acknowledged vulnerabilities where attackers exploit one AI agent to spread malicious instructions to others. This specific prompt injection bypasses standard LLM guardrails by targeting internal agent chains. Attackers can exfiltrate sensitive database contents through these trusted connections.