Skip to main content
Messages between agents carry no cryptographic identity proof — any party can spoof an agent

​
How to resolve

Require mutual authentication (mTLS, signed tokens) for all agent-to-agent communication. Verify sender identity before processing messages.

​
Risk

Governance/Compliance This vulnerability falls under ASI07:2026 — Insecure Inter-Agent Communication in the OWASP Top 10 for Agentic Applications. Agent-to-agent messages lack authentication, encryption, or semantic validation. Security Messages between agents carry no cryptographic identity proof — any party can spoof an agent. If exploited, this can compromise the agent’s integrity, confidentiality, or availability, potentially affecting downstream systems and data.

​
Explanation

Messages between agents carry no cryptographic identity proof — any party can spoof an agent. This falls under ASI07 (Insecure Inter-Agent Communication): Agent-to-agent messages lack authentication, encryption, or semantic validation.

​
Specifications

Trigger
  • Agent scan detects messages between agents carry no cryptographic identity proof — any party can spoof an agent
The scanner looks for patterns such as:
  • agent communication with no sender authentication
  • GroupChat with no speaker verification
  • agent messages trusted implicitly by role name
Severity
  • HIGH
Applies to: Agent