For Heads-of · Practitioner
Agent2Agent Protocol (A2A)
Also known as: A2A
An open protocol for AI agents from different vendors and frameworks to discover each other, describe what they can do and delegate tasks to one another. Google launched it in April 2025 and donated it to the Linux Foundation in June 2025.
- A2A
- AI agents
- multi-agent systems
- interoperability
- agent security
How it works
Each agent publishes an Agent Card describing its identity, capabilities and how to reach it. A client agent finds a suitable remote agent, sends it a task and receives the results, without either seeing the other's internal tools or memory. Where the Model Context Protocol connects an agent to tools and data, A2A connects agents to agents, and many systems use both.
Why every hop is a trust boundary
When one agent delegates to another, it passes on instructions and data and acts on what comes back. A compromised or malicious agent can return content that redirects the caller, which is agent goal hijack delivered through another agent, and one failure can spread along a chain. OWASP lists insecure inter-agent communication and cascading failures among the top agentic risks.
Controls
Authenticate agents before trusting them, verify signed Agent Cards where the implementation supports them, treat everything a remote agent returns as untrusted input, limit what a delegated task can do, and log the chain of delegation so that actions can be traced. The register entries are excessive agency in autonomous agents and prompt injection.
Sources
Related Terms
Agent Goal Hijack
Redirecting an AI agent's objective or plan, usually by placing instructions in content the agent reads, so that it pursues the attacker's goal with its own tools and permissions. It is the agentic form of prompt injection and the first item in OWASP's Top 10 for Agentic Applications (ASI01).
Agentic AI
An AI system that pursues a goal by deciding for itself which actions to take, in what order, using tools and other systems it has been given access to, with a person checking some or none of the steps. The governance change is that the unit of risk stops being a single output and becomes a sequence of actions with consequences.
Model Context Protocol (MCP)
An open protocol for connecting AI applications to external tools and data through servers that expose tools, resources and prompts. It has become the standard way to give an AI agent access to other systems, which makes its trust model the agent's attack surface: every connected server can steer the model as well as serve it.
Non-Human Identity
Any identity used by software rather than a person to authenticate to other systems, such as service accounts, API keys and tokens. AI agents now hold and use many of them, which makes agent identity one of the main access-control questions in AI governance.
OWASP Top 10 for Agentic Applications
OWASP's list of the ten most critical security risks specific to autonomous AI agents, published in December 2025. It complements the OWASP Top 10 for LLM Applications by covering what only goes wrong when a model acts: hijacked goals, misused tools, poisoned memory and failures that cascade between agents.