T12 (Communication Poisoning) via Document Injection in Knowledge-Intensive

How the attack unfolds

1. 1. The setup

   The target is a Knowledge-Intensive Agent Architecture. Agents focused on leveraging and processing large volumes of external data, typically using sophisticated RAG approaches. Employs chain of thought for reasoning over retrieved knowledge and data connectors for accessing persistent knowledge stores.

2. 2. The attack

   Indirect prompt injection through documents is a critical threat. Attackers can embed malicious instructions in documents that get retrieved and processed, causing the agent to execute unauthorized actions or leak information.

   Threat T12 · Component KC2 · Medium

3. 3. Technique: Side Channel Data Leakage

   Using covert channels to exfiltrate information. The threat catalog rates this T12 vector high.

   Threat T12 · Component KC2 · High

4. 4. Threat: T12 Communication Poisoning

   T12 Agent Communication Poisoning: Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.

   Threat T12 · Component KC4 · Medium

5. 5. In the wild: Semantic injection via unencrypted communications

   ASI07 Insecure Inter-Agent Communication in the OWASP Top 10 for Agentic Applications describes the same pattern: Over HTTP, a MITM attacker injects hidden instructions, causing agents to produce biased or malicious results.

   Threat T12 · Component KC2 · Medium

Threats involved

• T12 Agent Communication Poisoning: Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.

Controls that stop it

• M1 Memory Validation & Sanitization

  Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.

• M3 Secure Inter-Agent Communication

  Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.

• M10 Defense-in-Depth Architecture & Trust Boundaries

  Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.

• M15 Agent Identity & Authentication Framework

  Implement comprehensive agent identity management with decentralized identifiers, verifiable credentials, and strong authentication to prevent identity spoofing, enable secure agent discovery, and support agent reputation systems.

• M19 MCP Server Hardening & Tool Provenance

  Treat every MCP server, A2A peer and tool definition as an untrusted, versioned dependency: admit only allow-listed and verified servers, authenticate and authorize every protocol request, validate and screen tool metadata and results before they reach the model, and require re-approval when a tool definition changes.