Skip to main content
Inter-agent communication sent over plain HTTP or unencrypted channels — susceptible to interception

​
How to resolve

Use TLS/HTTPS for all inter-agent communication. Never transmit agent messages over plain HTTP. Enable certificate verification.

​
Risk

Governance/Compliance This vulnerability falls under ASI07:2026 — Insecure Inter-Agent Communication in the OWASP Top 10 for Agentic Applications. Agent-to-agent messages lack authentication, encryption, or semantic validation. Security Inter-agent communication sent over plain HTTP or unencrypted channels — susceptible to interception. If exploited, this can compromise the agent’s integrity, confidentiality, or availability, potentially affecting downstream systems and data.

​
Explanation

Inter-agent communication sent over plain HTTP or unencrypted channels — susceptible to interception. This falls under ASI07 (Insecure Inter-Agent Communication): Agent-to-agent messages lack authentication, encryption, or semantic validation.

​
Specifications

Trigger
  • Agent scan detects inter-agent communication sent over plain HTTP or unencrypted channels — susceptible to interception
The scanner looks for patterns such as:
  • http:// URL used for agent endpoint communication
  • no TLS configured on agent server
  • plain socket communication between agents
Severity
  • HIGH
Applies to: Agent