AI threat catalogueAgentic and Autonomous AIProduction
Insecure Inter-Agent Communication (A2A/MCP)
In multi-agent systems, agents exchange messages and discover tools through shared registries, for example via the A2A or MCP protocol. Without reliable mutual authentication, an attacker can impersonate a legitimate agent.
Description
Agent-to-agent protocols such as A2A (Agent2Agent) and MCP (Model Context Protocol) let agents delegate tasks to other agents and discover tools through shared registries. Many implementations rely on weak or missing mutual authentication. An attacker can register an agent with a similar name or capability description, intercept messages, or impersonate the intended recipient toward a delegating agent. The delegating agent effectively transfers its own rights to the impersonating participant.
Possible impact
An impersonating agent can take over delegated tasks, return manipulated results, or exfiltrate intercepted data, all with the privileges of the system that trusted it. In interconnected multi-agent architectures, a single compromised participant can affect multiple workflows. The EU AI Act requires resilience against third-party manipulation attempts and effective risk management.
Example
A research agent delegates a subtask to a data-retrieval agent via a shared registry. An attacker registers a malicious agent there with a near-identical name and matching capability description. The selection logic picks the malicious agent instead of the legitimate one. It returns manipulated data or forwards the query, including sensitive details, to an external server.
Recommended mitigations (4)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Mutual authentication between communicating agentsTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Mutual authentication between communicating agents” is primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions.
Signed messages and trusted registry anchors for tool/agent directoriesTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents, Supply chain
- Reason for the classification
- “Signed messages and trusted registry anchors for tool/agent directories” is primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance.
Least-agency scoping of delegated rights per agent interactionTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents, Organization
- Complementary control type
- Governance & compliance
- Reason for the classification
- “Least-agency scoping of delegated rights per agent interaction” is primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by rules and oversight.
Isolation and kill-switch mechanisms for compromised agentsTechnical
- Effect
- Preventive, Impact-limiting, Corrective
- Implementation level
- Application, API & agents, Infrastructure, Use & operations
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Isolation and kill-switch mechanisms for compromised agents” is primarily technical: Architectural and runtime boundaries separate data, execution, or tenants and limit the spread of failures; complemented by binding workflows.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (6)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 ASI07:2026 Insecure Inter-Agent CommunicationASI07 Insecure Inter-Agent Communication, pp. 27–29 of the official PDF OWASP FoundationOriginal
- MITRE ATLAS AML.T0073 ImpersonationATLAS.yaml technique object with id AML.T0073 (pinned release v5.6.0) MITREOriginal
- MITRE ATLAS AML.T0110 AI Agent Tool PoisoningATLAS.yaml technique object with id AML.T0110 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 15(5) Accuracy, robustness and cybersecurityArticle 15(5), including the express references to data/model poisoning, adversarial examples/evasion, confidentiality attacks and model flaws European Union (EUR-Lex)Original
- EU AI Act Article 9(1), 9(2)(a), 9(2)(d) Risk management systemArticle 9(1), 9(2)(a), 9(2)(d), read with Article 9(3) European Union (EUR-Lex)Original
- GDPR Article 32(1)(b) Security of processingArticle 32(1)(b), read with Article 32(1) and 32(2) European Union (EUR-Lex)Original
Terms on this page
Glossary terms that occur in this entry. Every link leads to the full explanation.
- MCP (Model Context Protocol) Open standard through which a model connects to tools and data sources.
Related threats
More entries from the topic group Agentic and Autonomous AI.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Insecure Inter-Agent Communication (A2A/MCP)”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/insecure-inter-agent-communication/