AgentRFC: Security Design Principles and Conformance Testing for Agent Protocols

• URL: http://arxiv.org/abs/2603.23801v1
• Date: Wed, 25 Mar 2026 00:25:02 GMT
• Title: AgentRFC: Security Design Principles and Conformance Testing for Agent Protocols
• Abstract summary: Agent protocols enable autonomous agents to discover capabilities, delegate tasks, and compose services across trust boundaries.<n>Despite massive deployment, no systematic security framework for these protocols exists.<n>We present three contributions: the Agent Protocol Stack, the Agent-Agnostic Security Model, and AgentConform.
• Score: 2.1352949241716352
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: AI agent protocols -- including MCP, A2A, ANP, and ACP -- enable autonomous agents to discover capabilities, delegate tasks, and compose services across trust boundaries. Despite massive deployment (MCP alone has 97M+ monthly SDK downloads), no systematic security framework for these protocols exists. We present three contributions. First, the Agent Protocol Stack, a 6-layer architectural model that defines what a complete agent protocol must specify at each layer -- analogous to ITU-T X.800 for the OSI stack. Second, the Agent-Agnostic Security Model, 11 security principles formalized as TLA+ invariants, each tagged with a property taxonomy (spec-mandated, spec-recommended, aasm-hardening, aps-completeness) that distinguishes protocol non-conformance from framework-imposed security requirements. Third, AgentConform, a two-phase conformance checker that (i)extracts normative clauses from protocol specifications into a typed Protocol~IR with explicit Protocol/Environment/Adversary action separation, (ii)compiles the IR into TLA+ models and model-checks them against AASM invariants, then (iii)replays counterexample traces against live SDK implementations to confirm findings. We introduce the Composition Safety (CS) principle: security properties that hold for individual protocols can break when protocols are composed through shared infrastructure. We demonstrate this with formal models of five protocol composition patterns, revealing cross-protocol design gaps that individual protocol analysis cannot detect. Preliminary application to representative agent protocols reveals recurrent gaps in credential lifecycle, consent enforcement, audit completeness, and composition safety. Some findings are under coordinated disclosure; full evaluation details will be released in the complete version.

Related papers

• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• Formal Security Analysis of Agent Protocol Composition [11.199507689498736]
  Agent protocols define how agents use tools, delegate work, and coordinate across software systems.<n>We present AgentThread, a source-linked framework for security assurance analysis of agent protocols.
  arXiv  Detail & Related papers  (2026-06-27T02:16:57Z)
• A Technical Taxonomy of LLM Agent Communication Protocols [60.76747983053368]
  This study develops a technical taxonomy to classify and analyze large language models (LLMs) agent communication protocols.<n>The framework guides protocol selection and highlights open research gaps such as privacy and policy enforcement.
  arXiv  Detail & Related papers  (2026-06-17T14:45:20Z)
• LAP: An Agent-to-Instrument Protocol for Autonomous Science [6.00746946741668]
  Large language model agents now plan experiments, and self-driving laboratories execute them.<n>Every such system rebuilds the link between the reasoning agent and the physical instrument from scratch.<n>Recent agent-interoperability protocols clarify the agent-to-tool edge, and Google's Agent2Agent (A2A) the agent-to-agent edge.<n>We present the Lab Agent Protocol (LAP), a protocol that fills this gap.
  arXiv  Detail & Related papers  (2026-06-02T15:03:43Z)
• When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents [43.702131498259384]
  This paper systematically investigates Tool Description Poisoning (TDP), a novel semantic attack.<n>In TDP, malicious instructions are not embedded in a tool's executable code, but rather covertly injected into its descriptive metadata.<n>This work provides the first specialized security benchmark tailored for TDP, offering essential insights for securing the cognitive and planning layers of advanced agentic systems.
  arXiv  Detail & Related papers  (2026-05-22T08:34:48Z)
• Agent Name Service (ANS): A Proof-of-Concept Trust Layer for Secure AI Agent Discovery, Identity, and Governance in Kubernetes [0.0]
  This paper presents an implementation-oriented proof of concept for the Agent Name Service (ANS)<n>ANS is a DNS-inspired trust layer for AI agent discovery and interoperability.<n>We observe sub-10ms response in demonstrated service paths and full success for scripted demo deployment scenarios.
  arXiv  Detail & Related papers  (2026-04-29T01:24:27Z)
• Autogenesis: A Self-Evolving Agent Protocol [60.15939127351914]
  We introduce Autogenesis Protocol (AGP), a self evolution protocol that decouples what evolves from how evolution occurs.<n>We present Autogenesis System (AGS), a self-evolving multi-agent system that dynamically instantiates, retrieves, and refines protocol-registered resources during execution.
  arXiv  Detail & Related papers  (2026-04-16T14:04:06Z)
• Anumati: Proof of Adherence as a Formal Consent Model for Autonomous Agent Protocols [0.0]
  We propose a versioned, append-only consent model for agent-to-agent communication.<n>The model is instantiated as a non-breaking extension to two widely used agent protocols.
  arXiv  Detail & Related papers  (2026-04-16T10:48:21Z)
• Bridging Protocol and Production: Design Patterns for Deploying AI Agents with Model Context Protocol [0.0]
  The Model Context Protocol (MCP) standardizes how AI agents discover and invoke external tools.<n>Three protocol-level primitives remain missing: identity propagation, adaptive tool budgeting, and structured error semantics.<n>This paper identifies these gaps through field lessons from an enterprise deployment of an AI agent platform integrated with a major cloud provider's MCP servers.
  arXiv  Detail & Related papers  (2026-03-12T17:42:24Z)
• Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols [80.68060125494645]
  We study adaptive attacks by an untrusted model that knows the protocol and the monitor model.<n>We instantiate a simple adaptive attack vector by which the attacker embeds publicly known or zero-shot prompt injections in the model outputs.
  arXiv  Detail & Related papers  (2025-10-10T15:12:44Z)
• Scan-do Attitude: Towards Autonomous CT Protocol Management using a Large Language Model Agent [39.72587188702086]
  Large Language Model (LLM)-based agent framework is proposed to assist with the interpretation and execution of protocol configuration requests.<n>The agent combines in-context-learning, instruction-following, and structured toolcalling abilities to identify relevant protocol elements and apply accurate modifications.
  arXiv  Detail & Related papers  (2025-09-24T16:04:11Z)
• LLM-Assisted Model-Based Fuzzing of Protocol Implementations [9.512044399020514]
  Faults in protocol behavior can lead to vulnerabilities and system failures.<n>A common approach to protocol testing involves constructing Markovian models that capture the state transitions and expected behaviors of the protocol.<n>We propose a novel method that leverages large language models (LLMs) to automatically generate sequences for testing network protocol implementations.
  arXiv  Detail & Related papers  (2025-08-03T13:16:18Z)
• A survey of agent interoperability protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP) [0.8463972278020965]
  This survey examines four emerging agent communication protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP)
  arXiv  Detail & Related papers  (2025-05-04T22:18:27Z)
• A Survey of AI Agent Protocols [35.431057321412354]
  There is no standard way for large language models (LLMs) agents to communicate with external tools or data sources.<n>This lack of standardized protocols makes it difficult for agents to work together or scale effectively.<n>A unified communication protocol for LLM agents could change this.
  arXiv  Detail & Related papers  (2025-04-23T14:07:26Z)
• Subversion Strategy Eval: Can language models statelessly strategize to subvert control protocols? [50.62012690460685]
  This paper investigates how well AI systems can generate and act on their own strategies for subverting control protocols.<n>An AI system may need to reliably generate optimal plans in each context, take actions with well-calibrated probabilities, and coordinate plans with other instances of itself without communicating.
  arXiv  Detail & Related papers  (2024-12-17T02:33:45Z)
• CryptoFormalEval: Integrating LLMs and Formal Verification for Automated Cryptographic Protocol Vulnerability Detection [41.94295877935867]
  We introduce a benchmark to assess the ability of Large Language Models to autonomously identify vulnerabilities in new cryptographic protocols. We created a dataset of novel, flawed, communication protocols and designed a method to automatically verify the vulnerabilities found by the AI agents.
  arXiv  Detail & Related papers  (2024-11-20T14:16:55Z)
• On the Design and Security of Collective Remote Attestation Protocols [5.01030444913319]
  Collective remote attestation (CRA) is a security service that aims to efficiently identify compromised devices in a (heterogeneous) network. The last few years have seen an extensive growth in CRA protocol proposals, showing a variety of designs guided by different network topologies. We present Catt, a unifying framework for CRA protocols that enables them to be compared systematically.
  arXiv  Detail & Related papers  (2024-07-12T12:06:49Z)
• Protocols to Code: Formal Verification of a Next-Generation Internet Router [9.971817718196997]
  SCION routers run a cryptographic protocol for secure packet forwarding in an adversarial environment. We verify both the protocol's network-wide security properties and low-level properties of its implementation. This paper explains our approach, summarizes the main results, and distills lessons for the design and implementation of verifiable systems.
  arXiv  Detail & Related papers  (2024-05-09T19:57:59Z)
• A Survey and Comparative Analysis of Security Properties of CAN Authentication Protocols [92.81385447582882]
  The Controller Area Network (CAN) bus leaves in-vehicle communications inherently non-secure. This paper reviews and compares the 15 most prominent authentication protocols for the CAN bus. We evaluate protocols based on essential operational criteria that contribute to ease of implementation.
  arXiv  Detail & Related papers  (2024-01-19T14:52:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.