Insecure Inter-Agent Protocol Abuse
- Inter-Agent Communication
- Tools & External Data
Attackers exploit weaknesses in the coordination protocols agents speak — chiefly MCP and A2A — to bypass consent checks, hijack a protocol transition, or corrupt shared context, turning the connective tissue of a multi-agent system into an actuation path.
What it is
Insecure inter-agent protocol abuse targets the protocol layer itself rather than the content a message carries: where Agent Communication Poisoning (T12) injects false data into an otherwise-trusted channel, this threat exploits flaws in how the channel's own transitions, consent flows, and metadata are handled, so an attacker can bypass a safeguard the protocol was supposed to enforce.
It is a first-class agentic threat added in the v1.1 taxonomy precisely because the standardizing protocols that make multi-agent and tool-augmented systems interoperable — MCP for tool and context exchange, A2A for agent-to-agent coordination — also standardize an attack surface: a single protocol weakness is reachable across every implementation that speaks it, and because the protocol sits beneath the model's reasoning, an abuse of it can redirect an agent without ever appearing in the prompt the model sees.
Kinds
- Transition hijack & consent bypass
- An attacker crafts malicious or malformed coordination messages that mimic a legitimate protocol transition or skip a consent check, redirecting a sensitive task or triggering an unauthorized operation.
- Context & memory corruption
- By injecting or overwriting the shared context or memory signals a protocol carries, an adversary manipulates an agent's objectives or the orchestration flow, so agents execute unintended actions.
- Tool-metadata & description exploitation
- A compromised or spoofed MCP server advertises tool descriptions or schemas crafted to be misinterpreted, so the agent invokes a capability believing it does something other than what it does.
Attack scenarios
A malformed MCP message mimics a legitimate protocol transition and skips the consent step a tool call should have required, so a specialist agent executes a sensitive operation the orchestrator never approved.
Poisoned tool description
A public MCP server exposed to a coding agent is manipulated so a tool-description field smuggles instructions the agent treats as part of its task, exfiltrating private repository data during an ordinary request.
Replayed hand-off
An attacker replays a captured A2A hand-off message to re-trigger a privileged operation the receiving agent already performed, because the channel lacked replay protection.
Consent-flow bypass
A malformed consent-flow message routes a high-value approval past the human gate the protocol was supposed to invoke.
Adversary-in-the-middle rewrite
An attacker on an unencrypted inter-agent link silently rewrites a coordination message so two cooperating agents act on different versions of the shared plan.
Documented incidents
Public cases, each checked against its primary source. A research demonstration shows the attack works against real systems; it is not a reported breach.
WhatsApp MCP “rug pull”
A malicious MCP server showed a harmless tool description at installation and swapped in a malicious one on its second launch, without asking for re-approval. The new description made the agent send the user's WhatsApp history out through the separate, trusted WhatsApp MCP server.
Invariant Labs, “WhatsApp MCP Exploited: Exfiltrating your message history via MCP”Claude Code runs project MCP servers before consent (CVE-2025-59536)
An MCP server declared in a cloned repository's configuration started its command as soon as Claude Code launched — before the user could read, let alone accept, the trust dialog. The protocol's consent step was bypassed. Fixed in version 1.0.111.
Check Point Research, “Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files”Mitigations
- Authenticate and encrypt the protocol, not just the payload
- Require mutual authentication and encryption for every MCP/A2A exchange, with replay protection and message-integrity checks, so a forged, replayed, or intercepted protocol message can't pass as legitimate — the discipline behind the A2A Protocol, extended down to the transport.
- Validate protocol-level data
- Sanitize and validate context payloads, tool metadata, and transition messages before acting on them, treating a tool description from an external server as untrusted input rather than trusted configuration.
- Scope and segment delegation
- Restrict agent-to-agent delegation to tightly scoped functions per Permission-scoped Tools, and sandbox the MCP/A2A surface so a compromised protocol endpoint can't escalate past its role.
- Sign identities and attest registries
- Verify signed agent cards and pull tools only from attested registries (an Agent Naming Service / PKI discipline), so an agent can't be addressed or impersonated over the protocol under a forged identity.