A2A protocol security flaws exposed through systematic analysis
A2ABreak: Systematic Security Analysis of the A2A Protocol
Cryptography and SecuritySoftware Engineering
Summary
The Agent2Agent protocol lets AI agents talk and share tasks safely, but its security had never been fully checked. The authors created a detailed model from its written rules using AI help, then tested it for weaknesses. They found 11 security problems that could be used by attackers following the rules, such as stealing credentials or injecting false data. Their method was much better than using AI alone, showing that formally analyzing the protocol is crucial for finding hidden risks.
What this means in practice
- •For software security teams: Identify and mitigate vulnerabilities in AI communication protocols crossing organizational boundaries using formal models derived from specifications.
- •For enterprise integration engineers: Enhance trust and security in multi-agent AI ecosystems by applying systematic protocol checks avoiding credential and data theft risks.
Authors
Alireza Lotfi, Mirza Masfiqur Rahman, Imtiaz Karim, Elisa Bertino
Abstract
The Agent2Agent (A2A) protocol, now governed by the Linux Foundation, is an open standard that enables autonomous AI agents to discover, authenticate with, and delegate tasks to one another across organizational boundaries. Designed to complement the Model Context Protocol (MCP) for tool integration, A2A is rapidly emerging as the horizontal communication layer of the multi-agent ecosystem. Yet the protocol's security has received no systematic analysis. This paper presents A2ABreak, the first rigorous systematic security analysis of the A2A protocol. We introduce a novel framework that utilizes an LLM-assisted extraction of a verified finite-state machine directly from the natural-language specification, producing a unified model of 37 states and 76 transitions from 929 formalized statements, and then systematically reasons over this model to discover protocol-level vulnerabilities through adversarial verification, under a full-compliance assumption. Our analysis uncovers 11 new vulnerabilities, each exploitable by a specification-compliant adversary without requiring any implementation flaw. Among the findings are cross-client context injection through unprotected context identifiers, credential harvesting via multi-hop identity loss in delegation chains, and data exfiltration through rogue agents advertising unattested capability claims. A2ABreak achieves 73.3% precision and 84.6% F1 against independent expert review, while a zero-shot LLM baseline operating over the same specification produces zero confirmed findings, demonstrating that explicit formal grounding is essential for sound protocol security analysis.