A2A protocol security exposes new agent-to-agent trust gaps

At a glance

What this is: This is Semgrep’s analysis of A2A protocol security, arguing that agent-to-agent interoperability creates trust gaps around identity proof, consent, token scope and stream handling.

Why it matters: It matters because IAM and security teams will need to govern agent coordination as a distinct access model, not just another API integration pattern.

Context

A2A is a communication standard for LLM agents to talk to other LLM agents, which changes the identity problem from simple tool access to coordinated machine-to-machine delegation. The security gap is that existing control models often assume a request comes from a stable actor with predictable intent, while agentic systems can route tasks, data and decisions across multiple services in one workflow.

Semgrep’s analysis focuses on where that model breaks down in practice: discoverable endpoints, unsigned Agent Cards, implementation-defined authorisation, and shared context across intermediate agents. For IAM, the question is no longer whether the transport is familiar, but whether each participating agent has a defensible identity, scope and consent boundary.

The article’s starting position is typical of early agentic protocol adoption: the standard is ahead of the governance model. That is the normal pattern when a new coordination layer becomes usable before security assumptions are fully reworked.

Key questions

Q: What breaks when A2A Agent Cards are not signed or verified?

A: Unsigned Agent Cards weaken the first trust decision in an agent-to-agent exchange because consumers cannot reliably confirm who they are talking to before work begins. That creates a spoofing path for malicious agents, especially where endpoints are easy to discover and downstream actions are automatically trusted.

Q: Why do coarse OAuth scopes create risk in agent-to-agent workflows?

A: Coarse scopes let one agent carry more authority than a single task requires, so a token that was meant for one delegated action can be reused for unrelated resources or data. In A2A environments, that turns delegation into overreach and makes downstream abuse much easier.

Q: How do security teams know if agent tokens are too permissive?

A: Look for tokens that are long-lived, reusable across services, or visible to the agent runtime itself. Those signs mean the credential can survive beyond the task and beyond the intended audience. A safe design binds the token to one resource server, limits its lifetime, and keeps it out of model context.

Q: What is the difference between A2A coordination and MCP tool access?

A: A2A governs agent-to-agent communication, while MCP governs agent-to-tool access. That distinction matters because tool access may be tightly bounded by a single agent, whereas A2A introduces a second trust boundary where identity, consent and delegation must survive between independent agents.

Technical breakdown

Unsigned Agent Cards and agent spoofing

An Agent Card is the protocol object that advertises an agent’s capabilities, auth schemes and endpoint. Semgrep notes that A2A supports, but does not require, signing of Agent Cards, which means discovery can become a spoofing problem as soon as an attacker can publish or imitate a card. In practice, this is closer to identity assertion than transport security: if the card is unauthenticated, the consumer cannot reliably know who is on the other end before initiating work. The risk is not just deception. It is downstream trust in a machine identity that was never strongly proven.

Practical implication: treat Agent Card authenticity as an identity control, not a metadata convenience.

OAuth scope, consent and delegated data sharing

A2A allows OAuth-based access, but the article highlights three gaps: token lifetime is not enforced as short-lived, scopes can be too coarse, and the protocol does not require user approval before an agent shares sensitive data with another agent. That combination creates a delegation problem, not simply an authentication problem. If one agent can forward payment or identity data to another without protocol-level consent, the original access decision stops being meaningfully bounded. This is especially important in workflows where one agent acts as a broker for several downstream tasks and the full data path is not visible to the person who initiated it.

Practical implication: align token scope and consent logic to the downstream data path, not just the first agent that receives the task.

Stream hijacking and shared context exposure

The protocol’s support for multiple concurrent streams creates a post-exploitation opportunity if a session token is stolen or forged. Semgrep also warns that sensitive data may pass through intermediate agents or live in a shared agent context, which means the attacker does not need to break the entire workflow to gain value. Once a stream can be passively observed or manipulated, result integrity and confidentiality both degrade. In agentic systems, the security question is not only whether a task completes, but whether every participant in the conversation remains the intended one throughout the session.

Practical implication: design stream isolation and session binding so one stolen token cannot shadow an entire agent conversation.

Threat narrative

Attacker objective: The objective is to hijack trust between agents so the attacker can observe, alter or redirect delegated work and the data moving through it.

1. Entry begins when an attacker identifies exposed A2A endpoints and uses discoverable Agent Cards to target the workflow.
2. Credential or trust abuse follows through forged or stolen session material, coarse OAuth scopes, or unauthenticated Agent Cards.
3. Escalation happens when the attacker listens to, injects into, or reroutes concurrent streams and shared agent context.
4. Impact is unauthorized compute use, data leakage, or manipulated outputs across coordinated agent tasks.

Breaches seen in the wild

• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent-to-agent interoperability creates an identity boundary problem before it creates an integration problem: A2A makes agent coordination easier, but it also expands the number of parties that must be trusted before work can proceed. Unsigned discovery objects, coarse scopes and shared context mean the control plane is no longer just authentication plus transport. The practical conclusion is that agent identity, delegation and consent must be treated as first-class governance concerns, not implementation details.

Capability-based access is becoming the right abstraction for agentic coordination: Semgrep’s analysis points to a familiar but underused model where the resource, not the requester, governs access. That matters because agentic systems can combine prompts, tools and downstream calls in ways that confuse conventional approval logic. For IAM teams, the field is moving toward resource-bounded authority rather than broad reusable credentials, especially where one agent can speak for another.

A2A weakens the assumption that a request comes from a single, stable operator: Traditional access review and session governance were built for actors whose intent and scope remain legible long enough to certify. That assumption breaks when agents coordinate at machine speed across multiple tasks, transient streams and intermediate hops. The implication is not simply more monitoring. It is a rethink of how delegation chains are validated when the actor can change context faster than review cycles can observe it.

A2A protocol security is really agentic trust governance in disguise: The article’s sharpest point is that the dominant risk is not the transport format, but whether trust can survive machine-to-machine coordination without becoming implicit. Security teams should read A2A as a signal that agent identity standards, authorisation patterns and consent boundaries will become architecture decisions. The practitioner conclusion is that agent collaboration needs explicit governance before broad deployment becomes routine.

Named concept, stream trust collapse: When multiple concurrent streams can coexist without mandatory termination, a stolen token can preserve access longer than the operator expects. That turns session integrity into a governance problem as much as a transport problem. Practitioners should treat stream control as part of identity assurance, not as a networking detail.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Agent identity governance now sits between protocol adoption and production rollout: Teams that enable A2A without a clear policy for card trust, scope limitation and session isolation will inherit a new class of delegated access risk. The operational issue is not whether agents can talk, but whether the organisation can still explain who authorised which exchange and why.

Stream trust collapse: Agentic systems make concurrent conversation state part of the security boundary. If one credential can listen to multiple live streams, the security model has already drifted away from user intent and toward ambient access that is difficult to audit or revoke.

AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026. That trend is a warning that agentic protocols will inherit the same credential exposure dynamics unless trust is narrowed at issuance time.

For practitioners

• Define agent identity boundaries before enabling A2A traffic Inventory every agent that can initiate, receive or broker A2A messages and assign a clear owning team, trust domain and approval path for each.
• Bind OAuth scope to task-specific authority Reduce reusable authority by constraining scopes to the exact downstream action and data set the agent needs for the current task.
• Require authenticated Agent Cards Reject unsigned or unverified Agent Cards in production paths so agent discovery does not become a spoofing entry point.
• Isolate streams and shared context Separate concurrent sessions and limit shared context so one compromised token cannot observe or steer unrelated agent interactions.

Key takeaways

• A2A makes agent coordination more scalable, but it also turns identity proof, consent and delegation into the primary security questions.
• The most material exposure paths are spoofed discovery, overbroad OAuth authority and stream-level session abuse across interconnected agents.
• Practitioners should govern agent trust as an explicit boundary with verified discovery, task-scoped access and isolated live sessions.

Key terms

• A2A: A2A, or agent-to-agent communication, describes interactions where one AI agent delegates work to another agent. These flows can be stateful, multi-step, and policy sensitive, so organisations need authentication, tracing, and guardrails to prevent uncontrolled delegation, unsafe data sharing, and opaque decision chains.
• Agent Card: An Agent Card is a machine-readable description of an agent’s capabilities, endpoint, and invocation details. In A2A-style systems it helps other agents discover and call the agent at runtime, which makes the card a governance object as much as a technical descriptor.
• Capability-Based Authorization: Capability-based authorization grants narrowly defined verbs on specific resources instead of broad role membership. For AI agents, that means the token should allow only the exact task steps required, because probabilistic behaviour can turn coarse permission into chained misuse.
• Stream Hijacking: Stream hijacking occurs when an attacker gains the ability to observe, inject into or redirect a live communication stream. In agentic workflows, it can expose task updates, data and outputs even when the original endpoint appears to be functioning normally.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.