T12 (Communication Poisoning) in Hierarchical

How the attack unfolds

1. 1. The setup

   The target is a Hierarchical Agent Architecture. This architecture introduces a KC2.2 (Hierarchical planning) model where a central orchestrator agent decomposes complex tasks and delegates them to specialized sub-agents. These sub-agents may use specialized KC1.1 or KC1.4 (Fine-tuned) models.

2. 2. The attack

   The shared KC4.2 memory is a critical channel for inter-agent communication. An attacker who compromises one agent can poison this shared memory to manipulate the behavior and decisions of all other agents relying on it for context.

   Threat T12 · Component KC4 · Medium

3. 3. Technique: Side Channel Data Leakage

   Using covert channels to exfiltrate information. The threat catalog rates this T12 vector high.

   Threat T12 · Component KC2 · High

4. 4. Threat: T12 Communication Poisoning

   T12 Agent Communication Poisoning: Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.

   Threat T12 · Component KC6 · Medium

5. 5. In the wild: Semantic injection via unencrypted communications

   ASI07 Insecure Inter-Agent Communication in the OWASP Top 10 for Agentic Applications describes the same pattern: Over HTTP, a MITM attacker injects hidden instructions, causing agents to produce biased or malicious results.

   Threat T12 · Component KC2 · Medium

Threats involved

• T12 Agent Communication Poisoning: Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.

Controls that stop it

• M1 Memory Validation & Sanitization

  Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.

• M3 Secure Inter-Agent Communication

  Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.

• M10 Defense-in-Depth Architecture & Trust Boundaries

  Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.

• M19 MCP Server Hardening & Tool Provenance

  Treat every MCP server, A2A peer and tool definition as an untrusted, versioned dependency: admit only allow-listed and verified servers, authenticate and authorize every protocol request, validate and screen tool metadata and results before they reach the model, and require re-approval when a tool definition changes.

• M15 Agent Identity & Authentication Framework

  Implement comprehensive agent identity management with decentralized identifiers, verifiable credentials, and strong authentication to prevent identity spoofing, enable secure agent discovery, and support agent reputation systems.