Communication poisoning is the manipulation of messages exchanged between AI agents so that one corrupted instruction or data point affects downstream decisions. The attack targets the coordination layer of a multi-agent system, where agents treat peer output as trusted input unless controls verify provenance and intent.
Expanded Definition
Communication poisoning is a trust-layer attack against agent-to-agent coordination, not a model failure in the narrow sense. In multi-agent systems, one agent’s output can become another agent’s instruction, retrieval input, or execution trigger. When that handoff is not checked, a poisoned message can propagate across workflow steps and alter planning, tool use, or decisions. The term is still evolving in industry usage, but the core idea is consistent: the attacker manipulates inter-agent communication so that downstream behaviour reflects untrusted upstream content. This is closely aligned with the governance lens used in the NIST Cybersecurity Framework 2.0, especially where system trust boundaries and information flow protections are concerned.
Unlike prompt injection, which usually targets a single model interaction, communication poisoning targets the relay between autonomous entities. It may involve forged messages, malicious context updates, tampered task instructions, or hidden control signals embedded in otherwise plausible agent output. Because agents often optimise for task completion, poisoned communications can be accepted without scrutiny if provenance, integrity, and intent are not verified. The most common misapplication is treating communication poisoning as ordinary prompt injection, which occurs when teams overlook message routing, agent handoffs, and trust inheritance across the coordination layer.
Examples and Use Cases
Implementing agent communication controls rigorously often introduces latency and orchestration overhead, requiring organisations to weigh automation speed against stronger verification at each handoff.
- A research agent forwards a summarised finding to a planning agent, but the summary has been altered to exaggerate confidence and steer the next decision.
- An orchestration agent relays a task instruction to a tool-using agent, and the message is poisoned with a hidden directive to change the execution scope.
- A retrieval workflow accepts peer-generated context as authoritative, causing one compromised agent to seed false data into later retrieval-augmented generation steps.
- An operational agent passes status updates to a response agent, and the update is manipulated so that the response logic suppresses escalation.
- A human reviewer sees only the final output, while the real compromise happened earlier through a corrupted agent-to-agent message chain.
For teams building agentic systems, the practical lesson is that every handoff is a security decision. Guidance from NIST Cybersecurity Framework 2.0 remains useful here because the control problem is less about isolated content and more about protecting trust boundaries, data integrity, and system resilience across the workflow.
Why It Matters for Security Teams
Communication poisoning matters because it turns collaboration into an attack path. Security teams may invest heavily in model hardening while leaving message integrity, provenance, and authorization between agents largely unchecked. That gap allows a single compromised component to influence planning, escalation, access requests, or automated remediation. In environments where agents can call tools or trigger actions, the impact can extend from bad recommendations to direct operational harm. Frameworks such as the NIST Cybersecurity Framework 2.0 help teams think in terms of protected communications, controlled interfaces, and resilient system design, which are central concerns in agentic AI security.
This term also has an identity angle when agents exchange secrets, credentials, or authorization context. If a poisoned message can alter a delegated action, it may influence access decisions or misuse non-human identities that were trusted to act on behalf of systems. Organisations typically encounter the seriousness of communication poisoning only after an agentic workflow produces an unexpected tool action, at which point message verification becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST AI 600-1 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | CSF addresses access and trust boundaries that communication poisoning exploits. |
| NIST AI RMF | AIRMF covers governance of AI risks, including harmful agent interaction patterns. | |
| NIST AI 600-1 | The GenAI profile helps frame risks from manipulated model outputs used as inputs. | |
| OWASP Agentic AI Top 10 | OWASP Agentic AI guidance highlights unsafe tool and message trust in agent workflows. | |
| CSA MAESTRO | MAESTRO addresses security controls for agentic orchestration and communication paths. |
Assign ownership for agent communication risks and require documented oversight for message integrity.
