A2ABreak: Systematic Security Analysis of the A2A Protocol

• URL: http://arxiv.org/abs/2609.10871v1
• Date: Wed, 09 Sep 2026 22:18:36 GMT
• Title: A2ABreak: Systematic Security Analysis of the A2A Protocol
• Abstract summary: This paper presents A2ABreak, the first rigorous systematic security analysis of the A2A protocol.<n>We introduce a novel framework that utilizes an LLM-assisted extraction of a verified finite-state machine directly from the natural-language specification.<n>Our analysis uncovers 11 new vulnerabilities, each exploitable by a specification-compliant adversary without requiring any implementation flaw.
• Score: 9.340181893879683
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The Agent2Agent (A2A) protocol, now governed by the Linux Foundation, is an open standard that enables autonomous AI agents to discover, authenticate with, and delegate tasks to one another across organizational boundaries. Designed to complement the Model Context Protocol (MCP) for tool integration, A2A is rapidly emerging as the horizontal communication layer of the multi-agent ecosystem. Yet the protocol's security has received no systematic analysis. This paper presents A2ABreak, the first rigorous systematic security analysis of the A2A protocol. We introduce a novel framework that utilizes an LLM-assisted extraction of a verified finite-state machine directly from the natural-language specification, producing a unified model of 37 states and 76 transitions from 929 formalized statements, and then systematically reasons over this model to discover protocol-level vulnerabilities through adversarial verification, under a full-compliance assumption. Our analysis uncovers 11 new vulnerabilities, each exploitable by a specification-compliant adversary without requiring any implementation flaw. Among the findings are cross-client context injection through unprotected context identifiers, credential harvesting via multi-hop identity loss in delegation chains, and data exfiltration through rogue agents advertising unattested capability claims. A2ABreak achieves 73.3% precision and 84.6% F1 against independent expert review, while a zero-shot LLM baseline operating over the same specification produces zero confirmed findings, demonstrating that explicit formal grounding is essential for sound protocol security analysis.

Related papers

• Zero-Knowledge Predicate Proofs Between AI Agents: A Measured, Cross-Protocol Gateway and the Source-Integrity Gap [0.0]
  Multi-agent AI platforms move quickly from staging to production, but the way agents establish trust remains rudimentary.<n>We take provable data minimisation between agents from proposal to running system.<n>A 32-bit threshold predicate proves in 6.2 ms and verifies in 1.0 ms with a 608-byte Bulletproofs proof.
  arXiv  Detail & Related papers  (2026-08-30T23:16:17Z)
• AI Slop and Hallucinations in Vulnerability Assessment: A Survey on Reasoning Failures and Trustworthy Mitigation [48.55515767840701]
  "AI slop" is artifacts, hallucinated vulnerabilities, plausible but incorrect patches, and semantically repackaged bug reports.<n>This paper surveys the empirical evidence, identifies a unifying mechanism, and traces a path toward trustworthy triage.
  arXiv  Detail & Related papers  (2026-08-26T11:48:38Z)
• VASO: Formally Verifiable Self-Evolving Skills for Physical AI Agents [57.240036084348354]
  We introduce VASO, a framework for verification-guided self-evolution of robot skill contracts.<n>VASO verifies logically inconsistent skill contracts, then verifies plans induced by the skill against global and local temporal specifications.<n>On Clearpath Jackal and PX4 quadcopter tasks, VASO reaches 97.2% formal-specification compliance using fewer than 100 optimization samples.
  arXiv  Detail & Related papers  (2026-06-03T20:02:35Z)
• LAP: An Agent-to-Instrument Protocol for Autonomous Science [6.00746946741668]
  Large language model agents now plan experiments, and self-driving laboratories execute them.<n>Every such system rebuilds the link between the reasoning agent and the physical instrument from scratch.<n>Recent agent-interoperability protocols clarify the agent-to-tool edge, and Google's Agent2Agent (A2A) the agent-to-agent edge.<n>We present the Lab Agent Protocol (LAP), a protocol that fills this gap.
  arXiv  Detail & Related papers  (2026-06-02T15:03:43Z)
• When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents [43.702131498259384]
  This paper systematically investigates Tool Description Poisoning (TDP), a novel semantic attack.<n>In TDP, malicious instructions are not embedded in a tool's executable code, but rather covertly injected into its descriptive metadata.<n>This work provides the first specialized security benchmark tailored for TDP, offering essential insights for securing the cognitive and planning layers of advanced agentic systems.
  arXiv  Detail & Related papers  (2026-05-22T08:34:48Z)
• ACIArena: Toward Unified Evaluation for Agent Cascading Injection [47.48169234218755]
  ACIArena is a framework for evaluating the robustness of Multi-Agent Systems.<n>It offers evaluation suites spanning multiple attack surfaces and attack objectives.<n>It covers six widely used MAS implementations and provides a benchmark of 1,356 test cases.
  arXiv  Detail & Related papers  (2026-04-09T04:03:13Z)
• LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operations [2.1142550386295853]
  This paper presents the LLM-assisted network Governance (LanG), an open-source, governance-aware agentic AI platform for unified security operations.<n>The platform supports multi-tenant isolation, role-based access, and fully local deployment.<n>Finetuned anomaly and threat detectors achieve weighted F1 scores of 99.0% and 91.0%, respectively, in intrusion-detection benchmarks.
  arXiv  Detail & Related papers  (2026-04-07T05:22:25Z)
• VulAgent: Hypothesis-Validation based Multi-Agent Vulnerability Detection [55.957275374847484]
  VulAgent is a multi-agent vulnerability detection framework based on hypothesis validation.<n>It implements a semantics-sensitive, multi-view detection pipeline, each aligned to a specific analysis perspective.<n>On average, VulAgent improves overall accuracy by 6.6%, increases the correct identification rate of vulnerable--fixed code pairs by up to 450%, and reduces the false positive rate by about 36%.
  arXiv  Detail & Related papers  (2025-09-15T02:25:38Z)
• The Aegis Protocol: A Foundational Security Framework for Autonomous AI Agents [0.0]
  The proliferation of autonomous AI agents marks a paradigm shift toward complex, emergent multi-agent systems.<n>This paper introduces the Aegis Protocol, a layered security framework designed to provide strong security guarantees for open agentic ecosystems.
  arXiv  Detail & Related papers  (2025-08-22T06:18:57Z)
• Improving Google A2A Protocol: Protecting Sensitive Data and Mitigating Unintended Harms in Multi-Agent Systems [3.398964351541323]
  Googles A2A protocol provides a secure communication framework for AI agents.<n>We identify key weaknesses of A2A: insufficient token lifetime control, lack of strong customer authentication, overbroad access scopes, and missing consent flows.<n>We propose protocol-level enhancements grounded in a structured threat model for semi-trusted multi-agent systems.
  arXiv  Detail & Related papers  (2025-05-18T16:25:21Z)
• EXPLICATE: Enhancing Phishing Detection through Explainable AI and LLM-Powered Interpretability [44.2907457629342]
  EXPLICATE is a framework that enhances phishing detection through a three-component architecture.<n>It is on par with existing deep learning techniques but has better explainability.<n>It addresses the critical divide between automated AI and user trust in phishing detection systems.
  arXiv  Detail & Related papers  (2025-03-22T23:37:35Z)
• CryptoFormalEval: Integrating LLMs and Formal Verification for Automated Cryptographic Protocol Vulnerability Detection [41.94295877935867]
  We introduce a benchmark to assess the ability of Large Language Models to autonomously identify vulnerabilities in new cryptographic protocols. We created a dataset of novel, flawed, communication protocols and designed a method to automatically verify the vulnerabilities found by the AI agents.
  arXiv  Detail & Related papers  (2024-11-20T14:16:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.