Trust gaps in the new protocol spread malicious prompts from one agent to another.