Agent-to-agent identity risk is exposing new east-west attack paths

At a glance

What this is: This is an analysis of how A2A and MCP-driven agent handoffs create new identity and access risks by moving trust decisions into fast, internal machine-to-machine traffic.

Why it matters: It matters because IAM, PAM, and NHI governance models built around human review and edge enforcement do not reliably control autonomous internal delegations between agents.

👉 Read Salt's analysis of agent-to-agent AI identity risk and east-west attack paths

Context

Agent-to-agent AI changes the identity problem from prompt handling to delegated execution. Once one agent can pass work to another through internal APIs, the security question is no longer only who asked, but which identity was trusted to continue the chain.

For IAM and NHI teams, that means the control point moves inside the workflow. If service accounts, API calls, and agent handoffs are treated as routine transport rather than privileged action, the organisation loses visibility exactly where the risk is highest.

Key questions

Q: How should security teams govern agent workflows at runtime?

A: Security teams should govern agent workflows with controls that evaluate prompts, tool calls, and outputs during execution, not only after deployment. Runtime checks matter because risk can appear at each stage of the workflow. The goal is to stop unsafe behavior before it becomes an executed action or a leaked response.

Q: Why do AI agents increase non-human identity risk?

A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission. That speed expands blast radius, shortens attacker dwell time, and makes weak delegation more dangerous. The remedy is tighter scoping, continuous verification, and strict separation between observation and execution privileges.

Q: What breaks when organisations rely only on perimeter controls for autonomous AI traffic?

A: They miss the most dangerous movement, which happens inside the environment. Agent-to-agent exchange is usually east-west traffic over internal APIs, so edge tools can see valid requests while remaining blind to the business logic being abused between trusted identities.

Q: Who is accountable when an AI agent delegation chain causes an unauthorised action?

A: Accountability depends on whether the organisation can reconstruct the chain. If logs capture sender identity, recipient identity, task ID, delegation depth, and validation results, investigators can pinpoint the failing handoff. Without that trail, responsibility becomes ambiguous across the orchestration layer and the individual agents.

Technical breakdown

How A2A and MCP create internal trust chains

A2A protocols and MCP enable agents to exchange context and tasks directly, often through service accounts and internal APIs. That makes each handoff a trust decision, not just a transport event. In a human-in-the-loop model, the user acts as a brake. In an agent-to-agent model, the next actor can execute immediately, preserving both context and authority across the chain. The security consequence is that a trusted upstream agent can become the carrier of malicious instructions without a traditional login event or obvious perimeter boundary crossing.

Practical implication: inventory agent-to-agent pathways as privileged workflows, not ordinary application traffic.

Why east-west visibility becomes the control gap

Most defensive tooling is still strongest at the edge, where north-south traffic is inspected before it enters or leaves the environment. Agent-to-agent exchange is different because it is largely east-west, inside the cloud or internal network, and frequently hidden behind undocumented or shadow APIs. That means the security stack may see valid credentials and normal transport while missing the business logic being abused. The failure is not authentication alone. It is the inability to judge whether an internal agent call is consistent with the expected behaviour of those identities.

Practical implication: extend API and runtime monitoring into internal agent conversations, not only internet-facing ingress points.

Behavioural baselines are stronger than static permission checks

When agentic systems can act within milliseconds, static allowlists and signature-based detection struggle to keep up. A valid credential does not prove a valid action. Behavioural baselining asks whether one identity normally requests this data, at this time, in this sequence, from that peer. That is closer to the real risk model for autonomous systems because the attack often looks like legitimate business logic executed incorrectly. This is where identity governance and runtime security intersect: access may be authorised, but the context of use can still be malicious.

Practical implication: tie runtime policy to behavioural baselines for agent identities and alert on out-of-pattern delegation.

Threat narrative

Attacker objective: The attacker wants to turn a single compromised agent interaction into trusted internal execution across multiple systems.

1. Entry occurs when a malicious prompt or poisoned context reaches the first agent in the chain and is accepted as valid work.
2. Escalation follows when that agent forwards the tainted instruction through internal APIs and service accounts to downstream agents with broader privileges.
3. Impact occurs when the downstream agent executes the malicious business logic, such as data retrieval, refund processing, or backend modification, without human review.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent-to-agent governance exposes a trust propagation problem, not just a permissions problem. Once one agent can delegate to another through internal APIs, the security model stops being about isolated identities and becomes about how trust is inherited across the chain. That matters because a compromised upstream agent can confer legitimacy on the next hop without a human approval point. Practitioners should treat delegated agent trust as a first-class governance object.

Human-in-the-loop review was designed for decision cycles that humans can interrupt. That assumption fails when agents exchange context and execute within milliseconds because the review window disappears before a human can intervene. The implication is that access certification, exception handling, and approval workflows need to be rethought for machine-paced delegation, not merely automated.

East-west agent traffic is the new blind spot in identity security. Security teams have historically focused on the perimeter, but agent-to-agent exchange lives inside the environment and often uses undocumented APIs or shadow endpoints. The practical result is that valid credentials can mask malicious business logic. IAM and NHI programmes need to govern the use of identity inside the mesh, not only at the edge.

Runtime intent is becoming more important than static authorisation in autonomous workflows. If a billing agent suddenly asks a database agent for a full table dump at an unusual time, the credential may be valid even when the action is not. That shifts the governance question from whether access exists to whether the call aligns with expected behaviour. Practitioners should prioritise intent-aware controls over static permission models.

Identity blast radius now depends on delegation depth as much as privilege level. In agentic systems, a small failure at the edge can cascade through multiple downstream services before any control plane sees it. That changes how teams should think about containment, because the damaging unit is no longer a single identity but the full chain of inherited trust. Security leaders should measure how far one compromised agent can travel before detection.

What this signals

Agent-to-agent governance will push IAM teams toward behaviour-based control models. The old assumption that access can be certified at provisioning time is too weak when identities can chain decisions dynamically. Programme owners should expect more demand for runtime policy, internal API visibility, and tighter privilege boundaries inside AI workflows.

Identity blast radius must become a measurable programme metric. If one agent can trigger several downstream actions before review, then containment is determined by delegation depth, not just account count. Teams should begin measuring how far a trusted identity can propagate before a control interrupts the chain.

For practitioners, the strategic move is to bring agent traffic into the same governance model used for other non-human identities, then extend it with intent-aware monitoring. That aligns the programme with zero trust principles and with the realities of autonomous execution, rather than assuming human-paced oversight will remain available.

For practitioners

• Map every agent-to-agent delegation path Document which identities hand work to which downstream agents, which service accounts support each call, and where undocumented or shadow API endpoints exist. Treat the handoff map as a privileged-access inventory for autonomous workflows.
• Classify internal agent calls as security events Set policy so east-west agent traffic is logged, enriched, and reviewed with the same seriousness as external authentication events. Focus on high-privilege calls, unusual timing, and requests that cross normal business boundaries.
• Add behavioural baselines for agent identities Define normal request patterns for each agent pair, including data volume, timing, sequence, and peer relationships. Use those baselines to flag calls that are validly authenticated but contextually abnormal.
• Rework approval gates around machine-speed execution Identify places where human approval is assumed to interrupt a workflow and decide whether that gate still exists once agents can delegate in milliseconds. Where the answer is no, redesign the control path before expanding autonomy.
• Limit privilege inheritance across the chain Reduce the amount of authority that one agent can pass to another, especially when service accounts are reused across multiple internal steps. The goal is to keep one compromised decision from becoming a broad backend action.

Key takeaways

• Agent-to-agent AI shifts the identity problem from prompt review to trust propagation across internal workflows.
• Traditional edge controls and static permission checks are not sufficient when valid credentials can carry malicious business logic inside the mesh.
• Practitioners should inventory delegation paths, baseline agent behaviour, and govern east-west traffic as privileged activity.

Key terms

• Agent-to-Agent Chain: A sequence of autonomous software entities handing work, context, or requests from one agent to another. Each hop can widen the trust boundary, weaken identity context, and create unreviewed access to systems or data if one link is unregistered or misconfigured.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Shadow API: An API endpoint that exists in production but is not fully known, reviewed, or governed by the security programme. Shadow APIs often emerge through fast delivery, copy-paste development, or overlooked internal routes, and they create untracked exposure because they sit outside inventory, policy, and ownership processes.
• Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.

What's in the full article

Salt's full article covers the operational detail this post intentionally leaves for the source:

• A closer look at the Agentic AI Action Layer and why Salt places detection there rather than at the edge.
• Examples of how internal agent calls can be baselined and flagged when behaviour deviates from normal peer-to-peer patterns.
• The vendor's own discussion of daisy-chained exploits across customer service, billing, and database agents.
• Operational framing for API attack surface assessment in agentic environments.

👉 Salt's full article covers cascading hallucinations, internal API blind spots, and runtime detection in agentic workflows

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.