T9 (Identity Spoofing) & T12 (Communication Poisoning) in Collaborative Agent Swarm

How the attack unfolds

1. 1. The setup

   The target is a Collaborative Agent Swarm. A collaborative swarm is a decentralized system where multiple peer agents operate without a strict hierarchy, using KC2.3 (Multi-agent collaboration). They can explore different solutions in parallel, often using advanced reasoning like KC3.4 (Tree of Thoughts).

2. 2. The attack

   In a decentralized P2P network, secure communication and verifiable identity are paramount. Without robust controls like mTLS and decentralized identifiers (DIDs), agents can be easily impersonated (T9), and communication channels can be poisoned (T12) to manipulate the entire swarm.

   Threat T9 · Component KC2 · High

3. 3. Technique: Certificate Spoofing

   Forging or stealing agent authentication certificates. The threat catalog rates this T9 vector high.

   Threat T9 · Component KC2 · High

4. 4. Threat: T9 Identity Spoofing

   T9 Identity Spoofing & Impersonation / Agent Identity Compromise: Impersonating trusted agents, users or services, or taking over an agent's own persistent identity and credentials, to act under a trusted identity. Especially problematic in hierarchical or collaborative multi-agent architectures and where agents hold long-lived directory identities.

   Threat T9 · Component KC2 · High

5. 5. Also in play: T12 Communication Poisoning

   T12 Agent Communication Poisoning: Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.

   Threat T12 · Component KC4 · Medium

6. 6. In the wild: Memory-Based Escalation

   ASI03 Identity & Privilege Abuse in the OWASP Top 10 for Agentic Applications describes the same pattern: An IT admin agent caches SSH credentials during a patch. A non-admin later reuses the session to create an unauthorized account.

   Threat T9 · Component KC2 · High

Threats involved

• T9 Identity Spoofing & Impersonation / Agent Identity Compromise: Impersonating trusted agents, users or services, or taking over an agent's own persistent identity and credentials, to act under a trusted identity.
• T12 Agent Communication Poisoning: Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.

Controls that stop it

• M3 Secure Inter-Agent Communication

  Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.

• M10 Defense-in-Depth Architecture & Trust Boundaries

  Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.

• M1 Memory Validation & Sanitization

  Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.

• M19 MCP Server Hardening & Tool Provenance

  Treat every MCP server, A2A peer and tool definition as an untrusted, versioned dependency: admit only allow-listed and verified servers, authenticate and authorize every protocol request, validate and screen tool metadata and results before they reach the model, and require re-approval when a tool definition changes.

• M15 Agent Identity & Authentication Framework

  Implement comprehensive agent identity management with decentralized identifiers, verifiable credentials, and strong authentication to prevent identity spoofing, enable secure agent discovery, and support agent reputation systems.