Owasp Agentic

title: 'ASI07: Insecure Inter-Agent Communication' description: OWASP Agentic Top 10 reference for insecure inter-agent communication vulnerabilities in multi-agent systems

07 Insecure Inter-Agent Communication

Identifier: ASI07:2026 Category: Communication Security

Description

Multi-agent systems depend on continuous communication between autonomous agents that coordinate via APIs, message buses, and shared memory, significantly expanding the attack surface. Decentralized architecture, varying autonomy, and uneven trust make perimeter-based security models ineffective. Weak inter-agent controls for authentication, integrity, confidentiality, or authorization let attackers intercept, manipulate, spoof, or block messages.

Insecure inter-agent communication occurs when these exchanges lack proper authentication, integrity, or semantic validation, allowing interception, spoofing, or manipulation of agent messages and intents. The threat spans transport, routing, discovery, and semantic layers, including covert or side-channels where agents leak or infer data through timing or behavioral cues.

This differs from ASI03 (Identity and Privilege Abuse), which focuses on credential and permissions misuse, and ASI06 (Memory and Context Poisoning), which targets stored knowledge corruption. ASI07 focuses on compromising real-time messages between agents.

Risk

• Interception and manipulation of real-time messages between agents to inject hidden instructions.

• Spoofing of agent identities or capabilities to redirect sensitive data through attacker infrastructure.

• Replay of delegation or trust messages to trick agents into granting unauthorized access.

• Protocol downgrade attacks that coerce agents into weaker communication modes.

• Cross-context contamination through modified or injected messages that blur task boundaries.

• Behavioral profiling through metadata analysis of traffic patterns, enabling prediction and manipulation of agent behavior.

• Conflicting agent actions from semantic divergence in message interpretation.

Vulnerability checklist

• Inter-agent messages are transmitted over unencrypted channels enabling man-in-the-middle semantic manipulation.

• Modified or injected messages can blur task boundaries between agents, leading to data leakage or goal confusion.

• Delegation or trust messages lack replay protection, allowing stale instructions to be honored.

• Agents can be coerced into weaker communication modes or accept spoofed agent descriptors.

• Discovery and coordination traffic can be misdirected to forge relationships with malicious agents.

• Traffic patterns reveal decision cycles and relationships, enabling behavioral profiling and manipulation.

Prevention controls

1. Use end-to-end encryption with per-agent credentials and mutual authentication. Enforce PKI certificate pinning, forward secrecy, and regular protocol reviews.

2. Digitally sign messages, hash both payload and context, and validate for hidden or modified natural-language instructions. Apply natural-language-aware sanitization and intent-diffing.

3. Protect all exchanges with nonces, session identifiers, and timestamps tied to task windows. Maintain short-term message fingerprints to detect cross-context replays.

4. Disable weak or legacy communication modes. Require agent-specific trust negotiation and bind protocol authentication to agent identity.

5. Reduce the attack surface for traffic analysis by using fixed-size or padded messages where feasible, smoothing communication rates, and avoiding deterministic schedules.

6. Define and enforce allowed protocol versions. Reject downgrade attempts or unrecognized schemas and validate that both peers advertise matching capability and version fingerprints.

7. Authenticate all discovery and coordination messages using cryptographic identity. Secure directories with access controls and verified reputations.

8. Use registries that provide digital attestation of agent identity, provenance, and descriptor integrity. Require signed agent cards and continuous verification before accepting messages.

Example attack scenarios

Scenario A — Semantic injection via unencrypted communications

Over HTTP or other unauthenticated channels, a MITM attacker injects hidden instructions, causing agents to produce biased or malicious results while appearing normal.

Scenario B — Trust poisoning via message tampering

In an agentic trading network, altered reputation messages skew which agents are trusted for decisions.

Scenario C — Context confusion via replay

Replayed emergency coordination messages trigger outdated procedures and resource misallocation.

Scenario D — Agent-in-the-Middle via descriptor poisoning

A malicious endpoint advertises spoofed agent descriptors or false capabilities. When trusted, it routes sensitive data through attacker infrastructure.

Scenario E — Semantics split-brain

A single instruction is parsed into divergent intents by different agents, producing conflicting but seemingly legitimate actions.

Detection guidance

• Monitor for anomalous routing flows in discovery and coordination channels.

• Detect protocol downgrade attempts or unrecognized schema versions in inter-agent exchanges.

• Track message replay attempts through nonce, session identifier, and timestamp validation.

• Analyze traffic patterns for signs of behavioral profiling or deterministic communication schedules.

• Validate that peers consistently advertise matching capability and version fingerprints.

• Monitor for unsigned or unattested agent cards in discovery registries.

Remediation

• Enforce end-to-end encryption with mutual authentication on all inter-agent communication channels.

• Deploy digital signatures on all messages with payload and context hashing.

• Implement nonce-based and timestamp-bound replay protection on all exchanges.

• Disable weak or legacy communication modes and enforce protocol version pinning.

• Remove unverified or suspicious entries from discovery registries and require signed agent cards.

• Use versioned, typed message schemas with explicit per-message audiences and reject failing validations.

Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Modifications: Restructured into agent-consumable reference format with added detection and remediation guidance.