Insecure Inter-Agent Protocol Abuse
- Inter-Agent Communication
- Tools & External Data
Attackers exploit weaknesses in the coordination protocols agents speak — chiefly MCP and A2A — to bypass consent checks, hijack a protocol transition, or corrupt shared context, turning the connective tissue of a multi-agent system into an actuation path.
What it is
Insecure inter-agent protocol abuse targets the protocol layer itself rather than the content a message carries: where Agent Communication Poisoning (T12) injects false data into an otherwise-trusted channel, this threat exploits flaws in how the channel's own transitions, consent flows, and metadata are handled, so an attacker can bypass a safeguard the protocol was supposed to enforce. It is a first-class agentic threat added in the v1.1 taxonomy precisely because the standardising protocols that make multi-agent and tool-augmented systems interoperable — MCP for tool and context exchange, A2A for agent-to-agent coordination — also standardise an attack surface: a single protocol weakness is reachable across every implementation that speaks it, and because the protocol sits beneath the model's reasoning, an abuse of it can redirect an agent without ever appearing in the prompt the model sees.
Kinds
- Transition hijack & consent bypass
- An attacker crafts malicious or malformed coordination messages that mimic a legitimate protocol transition or skip a consent check, redirecting a sensitive task or triggering an unauthorized operation.
- Context & memory corruption
- By injecting or overwriting the shared context or memory signals a protocol carries, an adversary manipulates an agent's objectives or the orchestration flow, so agents execute unintended actions.
- Tool-metadata & description exploitation
- A compromised or spoofed MCP server advertises tool descriptions or schemas crafted to be misinterpreted, so the agent invokes a capability believing it does something other than what it does.
Attack scenarios
A malformed MCP message mimics a legitimate protocol transition and skips the consent step a tool call should have required, so a specialist agent executes a sensitive operation the orchestrator never approved.
Malicious MCP server (GitHub MCP class)
A public MCP server exposed to a coding agent is manipulated so a tool-description field smuggles instructions the agent treats as part of its task, exfiltrating private repository data during an ordinary request.
Replayed hand-off
An attacker replays a captured A2A hand-off message to re-trigger a privileged operation the receiving agent already performed, because the channel lacked replay protection.
Consent-flow bypass
A malformed consent-flow message routes a high-value approval past the human gate the protocol was supposed to invoke.
Adversary-in-the-middle rewrite
An attacker on an unencrypted inter-agent link silently rewrites a coordination message so two cooperating agents act on different versions of the shared plan.
Mitigations
- Authenticate and encrypt the protocol, not just the payload
- Require mutual authentication and encryption for every MCP/A2A exchange, with replay protection and message-integrity checks, so a forged, replayed, or intercepted protocol message can't pass as legitimate — the discipline behind the A2A Protocol, extended down to the transport.
- Validate protocol-level data
- Sanitise and validate context payloads, tool metadata, and transition messages before acting on them, treating a tool description from an external server as untrusted input rather than trusted configuration.
- Scope and segment delegation
- Restrict agent-to-agent delegation to tightly scoped functions per Permission-scoped Tools, and sandbox the MCP/A2A surface so a compromised protocol endpoint can't escalate past its role.
- Sign identities and attest registries
- Verify signed agent cards and pull tools only from attested registries (an Agent Naming Service / PKI discipline), so an agent can't be addressed or impersonated over the protocol under a forged identity.