Inter-agent communication — ASI07 in the OWASP Top 10 for Agentic Applications 2026 — is the channel over which agents assign tasks, return results, and share context with other agents. When that channel lacks authentication, message validation, and delegation limits, every agent becomes an injection vector into every agent it can reach, and the practical security level of the whole system collapses to that of its weakest member.

Multi-agent architectures are becoming the default for serious workloads — orchestrators fanning out to specialists, pipelines of agents transforming each other's outputs — which makes A2A the fastest-growing attack surface in the agentic stack. This post covers the failure classes and the control set. It is one spoke of the complete OWASP Agentic AI Top 10 guide.

Why A2A is a different trust problem

Agent-to-agent traffic breaks an assumption that quietly underpins most internal-service security: that the caller's intent is trustworthy because the caller is ours. Between conventional services, a request is code calling code — the payload does what its schema says. Between agents, a request is language reaching a model: task descriptions, context blobs, and results that the receiving agent will reason over. That means an inbound A2A message can do something no conventional RPC can — persuade.

Three properties follow:

  • Compromise propagates upward. A low-privilege agent that has been goal-hijacked through a poisoned web page can craft messages to the orchestrator that trusts its results — and the orchestrator's privileges now serve the attacker. Privilege flows to whoever controls any voice in the conversation.
  • Trust becomes transitive by accident. If agent A trusts B, and B trusts C, then C effectively reaches A — through content relayed and re-emitted at each hop. Nobody designed that trust path; it emerged from pairwise defaults.
  • The blast radius is the org chart of your agents. A single-agent compromise is bounded by that agent's scope. In a connected fleet without A2A controls, it is bounded by the union of every reachable agent's scope.

The three failure classes

1. Unauthenticated peers — spoofing and rogue joiners. Systems where agents identify by name, by network position, or by a shared secret cannot distinguish the real planning agent from anything else on the same network claiming to be it. An attacker (or an ungoverned rogue agent) that can open a socket can inject tasks, harvest results, or sit in the middle of an entire workflow.

2. Unvalidated payloads — inter-agent injection. Even with authenticated peers, message content is a live attack channel: a compromised peer sends task payloads containing hijack instructions; results carry embedded steering content the receiver folds into its context; shared "context" blobs launder instructions from sources the receiver would never have trusted directly. Authenticating the pipe does nothing about what flows through it.

3. Unbounded delegation — privilege multiplication. The commonest shortcut in multi-agent systems is passing the parent's credential to sub-agents. Now every sub-agent compromise is a parent compromise; revocation is all-or-nothing; and the audit trail shows one identity doing everything. Delegation without scoping converts a fleet into a de facto shared super-credential — the ASI03 privilege-abuse failure, distributed.

The control set

Mutual authentication, per exchange

Both sides of every A2A exchange verify identity before task data moves — using per-agent credentials issued at registration, verified per request, and revocable individually. Network position is not identity; a shared "internal" trust zone is precisely the condition that lets one compromised agent speak as any agent. The mechanics — credential types, verification, per-request models for stateless agent calls — follow the same discipline as authenticating AI agents generally; A2A just applies it in both directions.

Scoped delegation tokens

When an orchestrator hands work to a sub-agent, the sub-agent receives a token bounded by the specific subtask and by the delegator's own authority — never the parent's full identity. Delegated authority narrows at each hop; tokens expire with the task; revoking one ends one delegation chain surgically. This single pattern eliminates the privilege-multiplication class and restores meaningful audit attribution: every action in the log names the delegation path that authorized it.

Message validation and in-band inspection

Agent-originated content is untrusted input. Structurally: schema-validate task payloads and results, rejecting free-form instruction fields where structured data is expected. Semantically: run inter-agent messages through the same in-band guardrails applied to user input and retrieved content — instruction-pattern detection on inbound tasks, sensitive-data detection on outbound results. The bidirectional guardrail model extends naturally: A2A is simply two more directions to inspect. An orchestrator that validates upstream claims before acting on them also breaks the transitive-trust chain at each hop.

Connection-level policy and circuit breakers

Treat each agent-to-agent connection as a governed object with its own policy envelope: rate limits (a compromised peer flooding tasks is both an attack and a cost event), circuit breakers that suspend a connection on error-rate or anomaly thresholds, and trust scoring per connection so a peer whose behavioral history degrades loses access automatically — the trust-score gating pattern. Connection-level breakers are also the containment primitive for cascading failures: the same mechanism that stops a malicious peer stops an innocently malfunctioning one.

Full-chain observability

Every A2A exchange — who called whom, under which delegation, with what policy outcome — lands in the same tamper-evident audit trail as everything else. Multi-agent incidents are reconstructed across hops; without chain attribution, an investigation dead-ends at the first inter-agent boundary.

Design guidance: topology is policy

Beyond per-exchange controls, the shape of your agent graph is itself a security decision. Prefer hub-and-spoke (agents communicate through a governed control plane) over ad-hoc mesh — a chokepoint gives authentication, inspection, and breakers one place to live, and keeps the reachable-set of any compromised agent explicit. Deny A2A by default: agents can message only peers they have an approved connection to, so "which agents can instruct the payments agent?" has a short, reviewable answer. And keep human-gated boundaries where chains cross privilege tiers — a low-tier research swarm should not reach a high-tier action agent without an approval step at the boundary.

Common questions

What does OWASP ASI07 cover? Insecure inter-agent communication: the risks arising when agents assign tasks, return results, and share context with other agents over channels lacking authentication, message validation, or delegation limits — letting an attacker use any reachable agent to instruct the others.

Why can't we just put all agents in a trusted network zone? Because the threat is not network eavesdropping — it is a legitimately connected agent being manipulated into sending malicious content. A trust zone authenticates the pipe, not the peer, and does nothing about payloads. A2A security requires per-agent identity, per-exchange verification, and content inspection regardless of network location.

What is the right way to handle delegation between agents? Scoped tokens: the sub-agent receives a credential bounded by the specific subtask and the delegator's own authority, expiring with the task. Never pass the parent's credential. This keeps privilege monotonically decreasing along the chain and makes revocation and attribution surgical.

Do inter-agent messages really need guardrails? Yes — they are the highest-trust instruction channel in the system, which is exactly why they are worth attacking. A hijacked peer's messages arrive with valid authentication; only content inspection catches the payload. Treat agent-originated content with the same suspicion as user input.

How does A2A security relate to cascading failures? ASI07 controls are the containment fabric for ASI08: authenticated, policy-governed, circuit-broken connections are what stop both malicious propagation and innocent error amplification. Building them once addresses both categories — the relationship is laid out in the Agentic Top 10 guide.