Attack Surface, Protocol, and Discovery: Three Shifts Reshaping Chatbots This Week

Three stories broke in the last few weeks that have nothing to do with a smarter model and everything to do with the chatbot stack growing teeth. Prompt injection became the fastest-growing attack category in security, full stop, not just in AI. The protocol your agent uses to reach tools is about to lock down its first enterprise-grade spec. And the way users find your product at all is quietly shifting from a search box to a chatbot's citation. Here's what changed and what to do about each one.

1. Prompt Injection Is Now the #1 AI Threat, and It's Cutting Both Ways

OWASP's 2026 LLM security report puts prompt injection attacks up 340% year-over-year, now the fastest-growing category of cyberattack industry-wide, not just within AI incidents. The technique also got a lot scarier in the last month: an indirect-injection technique researchers nicknamed "BioShocking" tricked six different agentic browsers and assistants at once — including ChatGPT Atlas, Perplexity Comet, and Anthropic's Claude Chrome plugin — into copying credentials from a signed-in session and pulling SSH keys out of a victim's GitHub account, all from content the agent merely read on a page. Separately, a financial services company spent three weeks with a customer-facing agent quietly leaking internal pricing data before anyone noticed a carefully worded question had talked it past its system prompt.

The pattern across every real incident is the same: the exploit doesn't come through the chat input box, it comes through content the model reads — a web page, a PR description, an email, a tool result — and treats as instructions instead of data. That's why input-side filtering on the user's message is close to useless against it.

• Treat every piece of tool output, retrieved document, and browsed page as untrusted input, the same way you'd treat user-submitted HTML
• Give agents the minimum permissions needed for the task, not the user's full session — an agent that can read a page shouldn't inherit the ability to read your SSH keys
• Log and diff what an agent actually does against what the user asked for; a support bot that suddenly calls a credentials API is a signal, not a footnote

// Don't let retrieved content dictate the tool-call plan — separate what
// the model reads from what it's allowed to decide.
const page = await fetchUntrusted(url);
const plan = await agent.plan({
  instructions: userMessage,      // the only source of intent
  context: sanitize(page),        // data only, never treated as instructions
});

Suggested visual: a flow diagram of the BioShocking-style attack path — attacker-controlled page → agent reads it → agent inherits session credentials → exfiltration — with the trust boundary marked where it should have been enforced.

2. MCP Is About to Freeze a Stateless, Enterprise-Grade Spec

The Model Context Protocol's 2026-07-28 release candidate marks its shift from "convenient default" to formal, enterprise-grade infrastructure. The headline change is a move to a stateless architecture: a remote MCP server that used to need sticky sessions, a shared session store, and deep packet inspection at the gateway can now sit behind a plain round-robin load balancer, route on a standardized Mcp-Method header, and let clients cache tools/list responses for as long as the server's TTL allows. OAuth also becomes a first-class citizen rather than something every server bolted on differently. MCP is now governed by the Linux Foundation's Agentic AI Foundation, with over 18,000 community-indexed servers and tens of millions of monthly SDK downloads — alongside Google's Agent-to-Agent protocol and IBM/AGNTCY's ACP, the three protocols now dominating serious production conversations about how agents reach tools and each other.

For teams already running MCP servers, the practical work is migration planning: the spec ships with a formal 12-month deprecation window for legacy session-based functionality, which is generous but not indefinite. For teams still hand-rolling tool-calling glue, this is the point where "wait for the standard to stabilize" stops being a reasonable excuse — it just did.

Suggested visual: a before/after architecture diagram — sticky-session MCP gateway with shared state, versus the stateless 2026-07-28 model behind a stock load balancer.

3. Your Users Are Finding You Through a Chatbot's Answer, Not a Search Result

Generative engine optimization (GEO) — getting cited, quoted, or named inside an AI-generated answer — is no longer a niche concern. More than 80% of the pages AI engines cite in 2026 don't rank in Google's top 10 at all, which means the content that wins in ChatGPT, Perplexity, or Google's AI Overviews is being selected by a different signal than classic SEO ever measured. Google AI Overviews now appear in roughly 55% of all Google searches, and Gartner's prediction that traditional search volume would drop meaningfully by 2026 as chatbots absorb query volume is playing out in the traffic numbers teams are seeing directly.

If your chatbot product also runs a marketing site, docs, or blog, the audience finding it is increasingly an AI system paraphrasing your content to a user who never clicks through. That changes what "good content" means: structured, directly quotable answers to specific questions now compete with — and often beat — content optimized purely for keyword ranking.

Suggested visual: a stacked bar comparing the overlap between a domain's Google top-10 rankings and its AI-engine citations, visualizing the 80%+ non-overlap.

Conclusion

None of these three shifts is about model quality. Prompt injection is a trust-boundary problem that gets worse as agents get more capable, not better. MCP going stateless is an operations problem — the protocol layer catching up to what production actually needs. And GEO is a distribution problem — the channel your users arrive through changing under you without an obvious dashboard alert. The common thread is the same one running through every trend this quarter: chatbots stopped being demos and started being systems with attack surfaces, protocols, and distribution channels that need to be engineered on purpose.

Engineering checklist:

1. Audit every place an agent reads untrusted content and confirm it can't silently become an instruction
2. Plan your MCP server migration against the 2026-07-28 stateless spec and its 12-month deprecation window
3. Check whether your own content gets cited in AI answers, not just where it ranks in Google

Sources:

• Prompt Injection Now Cuts Both Ways — Innovaiden
• Prompt injection: the OWASP #1 AI threat in 2026 — Securance
• The 2026-07-28 MCP Specification Release Candidate — Model Context Protocol Blog
• MCP 2026-07-28 spec: what changed, what breaks — Stacktree
• Mastering generative engine optimization in 2026 — Search Engine Land
• Generative engine optimization — Wikipedia

— Maya