Threat T12
Agent Communication Poisoning
Injection of malicious data into inter-agent communication channels or using external systems for side channel communications and memory persistence.
- 6/10 risk (High)
- 6 attack vectors
- 6 mitigating controls
- 12 framework refs
Overview
- Impact level: Medium
- Risk score: 6/10 (High)
- CIA impact: Confidentiality, Integrity
- Affected components: Agent Orchestration (KC2.1-KC2.5); Memory Modules (KC4.1-KC4.6); External Environment Interface (KC6.1-KC6.3)
- Tags: communication, poisoning, channels, encryption, protocols
- Source: OWASP Agentic AI T&M v1.1 (2025-12)
Attack vectors
How attackers carry out agent communication poisoning against an agentic system.
| Attack vector | Severity | Example |
|---|---|---|
| Message Injection | Medium | Injecting malicious messages into inter-agent communication |
| Protocol Manipulation | Medium | Exploiting communication protocol vulnerabilities |
| Side Channel Data Leakage | High | Using covert channels to exfiltrate information |
| Communication Eavesdropping | Medium | Intercepting sensitive inter-agent communications |
| Feedback Loop Poisoning | Medium | Corrupting agent feedback mechanisms |
| Broadcast Storm Attacks | Medium | Overwhelming communication channels with messages |
Affected components
KC2 Orchestration (Control Flow)
KC4 Memory Modules
- KC4.1 In-agent session memory
- KC4.2 Cross-agent session memory
- KC4.3 In-agent cross-session memory
- KC4.4 Cross-agent cross-session memory
- KC4.5 In-agent cross-user memory
- KC4.6 Cross-agent cross-user memory
KC6 Operational Environment (Agencies)
- KC6.1 API Access
- KC6.1.1 Limited API Access
- KC6.1.2 Extensive API Access
- KC6.2 Code Execution
- KC6.2.1 Limited Code Execution Capability
- KC6.2.2 Extensive Code Execution Capability
- KC6.3 Database Execution
- KC6.3.1 Limited Database Execution Capability
- KC6.3.2 Extensive Database Execution Capability
- KC6.3.3 Agent Memory or Context Data Sources (RAG)
- KC6.4 Web Access Capabilities (Web-Use)
- KC6.5 Controlling PC Operations (PC-Use)
- KC6.6 Operating Critical Systems
- KC6.7 Access to IoT Devices
Mitigating controls
Controls from the catalog that reduce the likelihood or impact of T12.
M1 Memory Validation & Sanitization
Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.
M3 Secure Inter-Agent Communication
Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.
M10 Defense-in-Depth Architecture & Trust Boundaries
Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.
M13 Secure Development Lifecycle Integration
Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
M15 Agent Identity & Authentication Framework
Implement comprehensive agent identity management with decentralized identifiers, verifiable credentials, and strong authentication to prevent identity spoofing, enable secure agent discovery, and support agent reputation systems.
M19 MCP Server Hardening & Tool Provenance
Treat every MCP server, A2A peer and tool definition as an untrusted, versioned dependency: admit only allow-listed and verified servers, authenticate and authorize every protocol request, validate and screen tool metadata and results before they reach the model, and require re-approval when a tool definition changes.
Framework mappings
OWASP Top 10 for Agentic Applications
- ASI04 Agentic Supply Chain Vulnerabilities
- ASI06 Memory & Context Poisoning
- ASI07 Insecure Inter-Agent Communication
Cisco AI Security Taxonomy
OWASP AIVSS core risks
- AIVSS #1 Agent Orchestration and Multi-Agent Exploitation AIVSS 10.0 (Critical)
- AIVSS #4 Agent Supply Chain and Dependency Risk AIVSS 9.7 (Critical)
- AIVSS #8 Agent Memory and Context Manipulation AIVSS 8.9 (High)
- AIVSS #2 Agentic AI Tool Misuse AIVSS 9.9 (Critical)
- AIVSS #3 Agent Access Control Violation AIVSS 9.7 (Critical)
- AIVSS #5 Agent Cascading Failures AIVSS 9.4 (Critical)
- AIVSS #6 Agent Identity Impersonation AIVSS 9.3 (Critical)
- AIVSS #10 Agent Goal and Instruction Manipulation AIVSS 7.1 (High)
OWASP AISVS
Chapters cited by the mitigating controls: C1 Training Data Integrity & Traceability, C2 Input Validation, C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C5 Access Control & Identity for AI Components & Users, C6 Supply Chain Security for Models, C8 Memory, Embeddings & Vector Database Security, C9 Orchestration & Agentic Security, C10 Model Context Protocol (MCP) Security, C12 Monitoring, Logging & Anomaly Detection.
Requirements: C8.1.3, C8.2.1, C8.2.2, C8.2.3, C8.2.4, C8.2.5, C8.3.1, C8.3.2, C8.3.3, C1.1.3, C1.1.4, C1.3.1, C2.1.3, C2.1.4, C12.5.4, C9.4.1, C9.4.2, C9.5.5, C9.5.7, C10.3.1, C10.3.5, C10.4.6, C5.1.2, C9.3.5, C9.3.6, C9.5.3, C5.2.5, C5.3.1, C4.1.1, C10.1.3, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C6.1.4, C9.4.3, C10.2.1, C10.2.2, C10.2.7, C10.1.1, C10.1.2, C10.2.4, C10.2.5, C10.3.3, C10.4.1, C10.4.2, C10.4.7, C10.4.8, C9.3.7, C6.1.2, C6.1.3.
MITRE ATLAS
- AML.T0005 Replicate AI Model Behavior
- AML.T0010 Supply Chain Compromise
- AML.T0012 Valid Accounts
- AML.T0017 Develop Capabilities
- AML.T0018 Manipulate AI Model
- AML.T0049 Exploit Public-Facing Application
- AML.T0051 LLM Prompt Injection
- AML.T0053 AI Agent Tool Invocation
- AML.T0055 Unsecured Credentials
- AML.T0067 LLM Trusted Output Components Manipulation
- AML.T0068 LLM Prompt Obfuscation
- AML.T0103 Deploy AI Agent
Attack walkthroughs
- Amazon Q Supply Chain Compromise: A poisoned prompt in the Q for VS Code repo ships to thousands before detection, showing how upstream agent-logic tampering cascades via extensions.
- Malicious MCP Server Impersonating Postmark: First in-the-wild malicious MCP server on npm impersonated postmark-mcp and secretly BCC'd emails to the attacker.
- Semantic injection via unencrypted communications: Over HTTP, a MITM attacker injects hidden instructions, causing agents to produce biased or malicious results.
- Agent-in-the-Middle via MCP descriptor poisoning: A malicious MCP endpoint advertises spoofed agent descriptors.
- A2A registration spoofing: An attacker registers a fake peer agent in the discovery service using a cloned schema, intercepting privileged coordination traffic.
- T12 (Communication Poisoning) in Hierarchical: The shared KC4.2 memory is a critical channel for inter-agent communication.
- T9 (Identity Spoofing) & T12 (Communication Poisoning) in Collaborative Agent Swarm: In a decentralized P2P network, secure communication and verifiable identity are paramount.
- T12 (Communication Poisoning) via Document Injection in Knowledge-Intensive: Indirect prompt injection through documents is a critical threat.
References
Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11