Agentic Security Hub

Threat T16

Insecure Inter-Agent Protocol Abuse

Attackers abuse the trust and control semantics of agent interoperability protocols such as MCP and A2A: manipulating server responses, injecting context, publishing misleading tool descriptions or exploiting ambiguous consent flows. Weak protocol enforcement or identity binding then lets them hijack agents, escalate privileges or bypass guardrails.

  • 8/10 risk (Critical)
  • 6 attack vectors
  • 7 mitigating controls
  • 11 framework refs

Open in Threat ModelerAll threats

Overview

  • Impact level: High
  • Risk score: 8/10 (Critical)
  • CIA impact: Confidentiality, Integrity
  • Affected components: Multi-agent Collaboration (KC2.3); Tool Integration Frameworks (KC5.1-KC5.3); MCP / A2A protocol endpoints, tool registries and consent flows
  • Tags: mcp, a2a, protocol, consent, tool-poisoning, inter-agent
  • Source: OWASP Agentic AI T&M v1.1 (2025-12)

Attack vectors

How attackers carry out insecure inter-agent protocol abuse against an agentic system.

Attack vectorSeverityExample
Consent-Flow ManipulationHighCrafting an A2A delegation whose ambiguous consent semantics make a downstream agent auto-approve a destructive action such as bulk deletion
Context Hijacking via Protocol ResponsesHighInjecting instructions into MCP tool results or resource contents that are merged into the model context
Misleading Tool Descriptions (Tool Poisoning)HighPublishing a tool in a shared registry whose description or schema steers agents into unsafe calls or shadows a trusted tool
Weak Identity Binding / Endpoint SpoofingHighRegistering a spoofed agent card or MCP server that impersonates a trusted service to receive delegated tasks and tokens
Adversary-in-the-Middle on Protocol TransportMediumIntercepting or replaying unauthenticated, unencrypted inter-agent messages to alter tasks or results
Shared Context CorruptionMediumCorrupting context or memory shared across protocol sessions so that later agents act on poisoned state

Affected components

KC2 Orchestration (Control Flow)

KC5 Tool Integration Frameworks

Mitigating controls

Controls from the catalog that reduce the likelihood or impact of T16.

  • M2 Tool Sandboxing & Isolation

    Implement defense-in-depth isolation for tool execution environments using containerization, virtualization, and strict resource controls to prevent tool misuse, contain breaches, and prevent unexpected code execution.

  • M3 Secure Inter-Agent Communication

    Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.

  • M6 Comprehensive Security Monitoring & Auditing

    Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.

  • M10 Defense-in-Depth Architecture & Trust Boundaries

    Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.

  • M15 Agent Identity & Authentication Framework

    Implement comprehensive agent identity management with decentralized identifiers, verifiable credentials, and strong authentication to prevent identity spoofing, enable secure agent discovery, and support agent reputation systems.

  • M19 MCP Server Hardening & Tool Provenance

    Treat every MCP server, A2A peer and tool definition as an untrusted, versioned dependency: admit only allow-listed and verified servers, authenticate and authorize every protocol request, validate and screen tool metadata and results before they reach the model, and require re-approval when a tool definition changes.

  • M20 Agent Supply-Chain Integrity

    Extend software supply-chain controls to everything an agent loads at build or run time: models and adapters, prompt templates, agent cards, tool and MCP server definitions, plugins and framework updates.

Framework mappings

OWASP Top 10 for Agentic Applications

Cisco AI Security Taxonomy

OWASP AIVSS core risks

OWASP AISVS

Chapters cited by the mitigating controls: C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C5 Access Control & Identity for AI Components & Users, C6 Supply Chain Security for Models, C9 Orchestration & Agentic Security, C10 Model Context Protocol (MCP) Security, C12 Monitoring, Logging & Anomaly Detection.

Requirements: C9.1.1, C9.3.1, C9.3.3, C9.3.4, C9.3.5, C9.3.6, C9.3.9, C4.1.1, C10.1.3, C9.4.1, C9.4.2, C9.5.5, C9.5.7, C10.3.1, C10.3.5, C10.4.6, C5.1.2, C12.1.1, C12.1.2, C12.1.3, C12.1.4, C12.2.1, C12.2.2, C12.4.2, C12.4.3, C12.5.3, C9.5.3, C5.2.5, C5.3.1, C9.4.3, C10.2.1, C10.2.2, C10.2.7, C10.1.1, C10.1.2, C10.2.4, C10.2.5, C10.3.3, C10.4.1, C10.4.2, C10.4.7, C10.4.8, C9.3.7, C6.1.2, C6.1.3, C6.1.1, C6.1.4, C6.2.1, C6.2.2, C6.2.3, C3.1.2, C3.1.3, C9.2.5.

MITRE ATLAS

Attack walkthroughs

References

Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11