Versatile AI Risk Assessment

AI threat catalogue Agentic and Autonomous AI Production

Insecure Inter-Agent Communication (A2A/MCP)

In multi-agent systems, agents exchange messages and discover tools through shared registries, for example via the A2A or MCP protocol. Without reliable mutual authentication, an attacker can impersonate a legitimate agent.

As of: October 2026 · Catalogue version 2026.10.24.2 · 4 mitigations · 6 verified sources

Description

Agent-to-agent protocols such as A2A (Agent2Agent) and MCP (Model Context Protocol) let agents delegate tasks to other agents and discover tools through shared registries. Many implementations rely on weak or missing mutual authentication. An attacker can register an agent with a similar name or capability description, intercept messages, or impersonate the intended recipient toward a delegating agent. The delegating agent effectively transfers its own rights to the impersonating participant.

Possible impact

An impersonating agent can take over delegated tasks, return manipulated results, or exfiltrate intercepted data, all with the privileges of the system that trusted it. In interconnected multi-agent architectures, a single compromised participant can affect multiple workflows. The EU AI Act requires resilience against third-party manipulation attempts and effective risk management.

Example

A research agent delegates a subtask to a data-retrieval agent via a shared registry. An attacker registers a malicious agent there with a near-identical name and matching capability description. The selection logic picks the malicious agent instead of the legitimate one. It returns manipulated data or forwards the query, including sensitive details, to an external server.

Recommended mitigations (4)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Mutual authentication between communicating agents

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions.

  • Signed messages and trusted registry anchors for tool/agent directories

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Supply chain
    Classification and rationale

    Primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance.

  • Least-agency scoping of delegated rights per agent interaction

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Organization
    Classification and rationale

    Complementary control typeGovernance & compliance

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by rules and oversight.

  • Isolation and kill-switch mechanisms for compromised agents

    Technical
    Effect
    Preventive, Impact-limiting, Corrective
    Implementation level
    Application, API & agents, Infrastructure, Use & operations
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Architectural and runtime boundaries separate data, execution, or tenants and limit the spread of failures; complemented by binding workflows.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 ASI07:2026MITRE ATLAS AML.T0073 · AML.T0110EU AI Act Article 15(5) · Article 9(1), 9(2)(a), 9(2)(d)GDPR Article 32(1)(b)

Verified references (6)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Achieve accuracy, robustness and cybersecurity Art. 15, Art. 42 Abs. 3 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028 · amended by Reg. 2026/1744

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    New: where a high-risk system falls within the scope of Regulation (EU) 2024/2847 on horizontal cybersecurity requirements and meets its conditions, it is deemed compliant with the cybersecurity requirements of Art. 15. Duplicate evidence is therefore not required.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

More entries from the topic group Agentic and Autonomous AI.

Excessive Agency An AI system is granted more permissions or freedom to act than its task requires. Misalignment The AI system does not pursue the goals its operator or users intend but whatever it was actually optimized for. Agentic AI / Autonomous Agents AI agents plan multi-step tasks on their own and carry them out with tools such as email, databases, or code execution.

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

For 5 further use cases, relevance depends on the system design, for example whether it is connected through the Model Context Protocol (MCP) or works with other AI agents. Show these use cases

Frequently asked questions

What is Insecure Inter-Agent Communication (A2A/MCP)?
In multi-agent systems, agents exchange messages and discover tools through shared registries, for example via the A2A or MCP protocol. Without reliable mutual authentication, an attacker can impersonate a legitimate agent.
Which mitigations help against Insecure Inter-Agent Communication (A2A/MCP)?
The catalogue lists 4 mitigations, each with control type, effect and implementation level. First among them are Mutual authentication between communicating agents, Signed messages and trusted registry anchors for tool/agent directories and Least-agency scoping of delegated rights per agent interaction.
Which EU AI Act obligations does Insecure Inter-Agent Communication (A2A/MCP) touch?
The catalogue maps this threat to Art. 9 and Art. 15 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system and Achieve accuracy, robustness and cybersecurity. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Insecure Inter-Agent Communication (A2A/MCP)”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/insecure-inter-agent-communication/

← Back to the full catalogue