Risk · R-055 · Agentic & Autonomous Systems
Insecure inter-agent communication
Messages between agents are not authenticated, authorised or validated, so one compromised or spoofed agent can instruct the others.
- Severity
- Medium
- Audience
- Practitioner
- Frameworks
- AML.M0032 · ASI07
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it is
In a multi-agent system, planners, workers and reviewers exchange messages that are acted on as instructions. If an agent cannot establish who sent a message, whether the sender may ask for what it asks, and whether the content is well formed, the channel between agents becomes a way around every control applied at the system's edge.
How it happens
- Agents accept any message that arrives on an internal channel.
- A compromised agent claims a role, such as supervisor, that others obey.
- Messages are altered or replayed in transit.
- Free-text messages carry injected instructions from one agent to the next.
Why it matters
Controls on user input do not see traffic between agents. One weak agent can therefore direct stronger ones, and the resulting action is attributed to an agent that behaved correctly on what it received.
Warning signs
- Agents share one identity or have none.
- Messages between agents are unstructured text.
- No log records which agent asked which to do what.
- A new agent can join the system without registration.
Mitigating controls
Primary controls
- Least-privilege agent identity and permissions Preventive
- Authenticates each agent and authorises what it may ask of others. Each agent has its own identity, with permissions scoped to its task and to the user it is acting for, short-lived and reviewed like any other entitlement.
Supporting controls
- Agent action tracing Detective
- Records exchanges between agents. Every agent action is recorded with the instruction, plan, tool call, result and identity that produced it, in a form that allows the sequence to be reconstructed.
- Input filtering and injection defence Preventive
- Treats messages from other agents as untrusted input. User input and all retrieved or tool-supplied content are screened for hostile instructions and passed to the model marked as data, separate from the system's own instructions.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| MITRE ATLAS | AML.M0032 | Segmentation of AI Agent Components Segmentation of agent components. |
| OWASP Top 10 for Agentic Applications | ASI07 | Insecure Inter-Agent Communication The entry this risk is named for. |
Sources
- MITRE ATLAS MITRE · framework
Related terms
How to cite
Axiom Verity (2026). Insecure inter-agent communication. Reference Library, R-055. https://axiom-verity.com/risks/insecure-inter-agent-communication. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.