research: A2A and inter-agent transport attack surface

[ksek87]

Problem

Google's Agent-to-Agent (A2A) protocol, Microsoft AutoGen, and Anthropic's own multi-agent patterns all use MCP for inter-agent communication. When agents communicate through shared MCP tools, a new attack class emerges: Agent A can poison Agent B's context through a tool they both use, even if neither agent's individual tool list looks malicious.

This maps to OWASP Agentic ASI07: Insecure Inter-Agent Communication — cross-protocol downgrade and relay-abuse attacks are documented in arXiv:2602.11327.

fuzzd currently models a single client ↔ server session. It has no model of multi-agent topologies.

Research questions

1. What does a minimal A2A topology look like that fuzzd could probe? (two agents, one shared MCP server)
2. What attack payloads are specific to inter-agent relay (as opposed to single-agent attacks)?
3. Does fuzzd need a new transport layer to speak A2A, or can existing MCP transport suffice?
4. What would a --attacks inter-agent module look like architecturally?

Known attack patterns (from arXiv:2602.11327)

• Downgrade attack: a malicious MCP server presents itself as an A2A endpoint, causing the client to use a weaker authentication model
• Relay-abuse: Agent A's OAuth token is forwarded transparently to Agent B's tool calls, granting unintended permissions
• Orchestrator manipulation: a rogue agent presents an inflated capability description to bias the orchestrator's LLM-based agent-selection logic
• C2 via MCP: MCP used as command-and-control infrastructure for offensive agent swarms (traffic semantically indistinguishable from legitimate enterprise AI use)

Acceptance criteria (research phase)

• Survey of A2A protocol spec and how it maps to MCP semantics
• Identify at least 2 concrete attack payloads specific to inter-agent communication
• Prototype: a minimal two-agent fixture (Agent A ↔ shared MCP server ↔ Agent B) for testing
• Architecture proposal: how would --attacks inter-agent integrate with fuzzd's current session model?
• Go/no-go decision: build or watch-and-wait pending A2A spec stabilization?

References

• MCP/A2A/ANP threat modeling: https://arxiv.org/html/2602.11327v2
• Zylos A2A/MCP convergence analysis: https://zylos.ai/research/2026-03-26-agent-interoperability-protocols-mcp-a2a-acp-convergence/
• OWASP Agentic ASI07: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/