TL;DR: Agent-to-agent workflows using A2A and MCP shift AI risk from human-reviewed prompts to millisecond internal handoffs, creating east-west attack paths that traditional edge controls often miss, according to Salt. The governing assumption that a human can still catch bad logic before execution is collapsing as agents act and delegate faster than review cycles can respond.
At a glance
What this is: Salt describes how agent-to-agent workflows built on A2A and MCP can create hidden east-west attack paths, where compromised logic propagates across trusted internal handoffs.
Why it matters: IAM, PAM, and identity teams need to treat autonomous agent traffic as governed identity behaviour, because valid credentials do not make delegated actions trustworthy.
Context
Agent-to-agent identity risk emerges when software entities hand work to each other faster than human review can intervene. In this model, the security issue is not only who can authenticate, but which agent can delegate, consume context, and execute downstream actions inside the same trust boundary.
Salt frames the problem around A2A and MCP because those protocols shift AI activity from isolated prompts into chained internal calls. That turns identity governance into an east-west control problem for agents, service accounts, and internal APIs rather than a perimeter problem at the edge.
Key questions
Q: What breaks when agent approval depends on human-style review workflows instead of runtime controls?
A: Human-style review breaks because it checks work after the fact and cannot keep pace with an agent that can take many actions quickly. That creates a bottleneck where promising pilots stall before production, or teams bypass governance with personal tokens and ad hoc connectors. In both cases, the organisation loses either velocity, visibility, or both.
Q: Why do authenticated agent calls still create security risk?
A: Authentication proves that a request came from a known identity, but it does not prove the request is legitimate in context. In agentic workflows, a valid call can carry poisoned intent from an upstream agent and still pass normal checks. Teams must judge behaviour and delegation, not just credential validity.
Q: How do teams detect unsafe agent-to-agent behaviour?
A: Look for internal calls that deviate from an agent’s normal sequence, timing, or target system. Examples include unexpected database pulls, unusual refund approvals, or off-hours escalation requests. Behavioural baselining is more useful than signature-only detection because the harmful action may be a valid business operation used in the wrong context.
Q: How should organisations govern east-west agent traffic?
A: Treat internal agent traffic as a governed trust path, not as harmless backend chatter. That means inventorying agents, limiting their privileges, and applying monitoring to internal APIs and service-account-backed calls. The governance question is who may delegate to whom, and under what conditions that delegation remains valid.
Technical breakdown
Why agent-to-agent identity turns internal traffic into a trust problem
Agent-to-agent workflows use internal API calls and service accounts to pass work from one software entity to another. That matters because the trust decision is no longer made only at login or at the user boundary. Once an agent forwards context, the next agent often treats that context as an internal instruction rather than an untrusted request. In practice, the security boundary moves from the edge to the delegation chain, where identity, context, and authorisation all travel together. Practical implication: model internal agent handoffs as privileged requests, not as routine application traffic.
Practical implication: model internal agent handoffs as privileged requests, not as routine application traffic.
How prompt injection becomes a cascading logic failure
In an A2A environment, prompt injection does not stop at the first compromised agent. If the initial agent accepts malicious input, it can pass poisoned context to downstream agents that trust the originating identity and execute the next step automatically. That creates a cascading logic failure: the exploit is not a single bad prompt, but a chain of valid-looking actions that preserve the attacker’s intent across multiple hops. This is especially dangerous when the workflow spans customer service, billing, and database access. Practical implication: inspect agent-to-agent dependencies for trust inheritance, not just input sanitation.
Practical implication: inspect agent-to-agent dependencies for trust inheritance, not just input sanitation.
Why east-west visibility matters more than edge controls
Traditional WAFs and API gateways are designed to inspect north-south traffic at the perimeter. Agent-to-agent communication is mostly east-west, often staying inside the cloud or private network and using undocumented internal endpoints. That means the most consequential negotiations between agents may never reach the tools teams already rely on for edge inspection. The technical gap is not only observability, but the assumption that internal calls are inherently safer than external ones. Practical implication: extend monitoring to internal API behaviour and agent baselines, not just perimeter traffic.
Practical implication: extend monitoring to internal API behaviour and agent baselines, not just perimeter traffic.
Threat narrative
Attacker objective: The attacker wants to turn one compromised agent into a trusted internal pivot that can influence downstream systems at machine speed.
- Entry occurs when an attacker uses prompt injection against an initial agent that handles customer-facing or workflow input.
- Credentialed propagation follows when the compromised agent forwards malicious context to downstream agents through trusted internal APIs and service accounts.
- Escalation happens as later agents execute the poisoned request against higher-value backend systems with valid privileges.
- Impact is achieved when the chained agents complete unauthorized actions, such as exposing data or triggering a fraudulent refund path.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agent-to-agent workflows create a delegation risk that perimeter identity models do not contain. Once software entities hand work to each other through internal APIs, the trust decision shifts from authentication to delegation. That changes the control problem for NHI governance, because valid credentials no longer prove that the downstream action is appropriate. Practitioners need to treat the delegation chain as the unit of risk, not the individual login.
Human-in-the-loop review is no longer a reliable safety assumption for autonomous handoffs. The article’s central insight is that millisecond agent-to-agent exchanges outpace any manual checkpoint. That means governance models built around review, approval, and exception handling can fail even when every identity is known and every call is authenticated. The implication is not merely more monitoring, but a rethinking of where authority sits in the workflow.
East-west visibility becomes an identity security requirement, not just a network telemetry problem. When agents communicate through undocumented internal endpoints, edge tooling only sees a fraction of the risk. This is where NHI governance, API security, and workload identity intersect: the same service account can authorize a request that is syntactically valid and operationally dangerous. Practitioners should assume that internal traffic can be the primary attack path.
Valid credentials do not equal valid intent in agentic systems. That distinction is now central to identity security across autonomous workflows, because service-account-backed calls can carry corrupted context from one agent to the next. Salt’s article reinforces a broader market shift: identity controls must move from static permission checking toward runtime judgement of behaviour. Teams that miss this will over-trust authenticated machine traffic.
Runtime behavioural governance is the named concept this architecture forces. A2A and MCP introduce autonomous supply chains of logic where the key question is whether one agent’s request still fits the normal pattern of another agent’s authority. That is a different control question from provisioning or recertification. The practitioner conclusion is clear: identity policy must account for sequence, delegation, and expected behaviour, not only entitlement state.
What this signals
Runtime behavioural governance: A2A and MCP push identity security away from static entitlement checks and toward live assessment of what one agent is doing on behalf of another. That matters because authenticated machine traffic can still be unsafe when context is corrupted mid-chain. Practitioners should expect the strongest controls to sit at issuance, delegation, and runtime inspection rather than at the perimeter.
Agentic workflows are collapsing the old separation between application logic and identity governance. Once internal handoffs become the main control surface, identity teams need to work more closely with API security and workload owners to define what a legitimate machine request looks like in motion.
For practitioners
- Inventory agent delegation chains Map every agent-to-agent path, including internal API hops, service accounts, and shadow endpoints that move work between agents. Document which downstream systems each agent can influence without human intervention.
- Constrain agent privileges by downstream task Reduce each agent to the smallest action set needed for its specific role, and separate customer-facing agents from billing, database, and remediation actions. Treat cross-domain access as an exception, not a default pattern.
- Monitor east-west agent behaviour Baseline normal agent call sequences, request timing, and payload patterns, then alert on unusual internal requests such as unexpected table dumps or off-cycle refund logic. Focus on behaviour inside the mesh, not only at the perimeter.
- Validate trust inheritance in A2A flows Review whether downstream agents automatically trust upstream context, and block workflows where one compromised agent can confer authority to the next without additional checks.
Key takeaways
- Agent-to-agent systems create identity risk inside the trust boundary, where service accounts and internal APIs can move malicious context as easily as legitimate work.
- The article’s core warning is that millisecond delegation chains can outrun human review, leaving traditional edge controls blind to the most important decisions.
- Governance has to shift toward runtime behavioural controls, tighter delegation rules, and visibility into east-west traffic between agents.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP API Security Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Agent-to-agent trust breaks when valid identities carry unsafe delegated context. |
| NHI-05 — Overprivileged NHI | The article ties risk to service accounts and agents with excessive internal privileges. | |
| NHI-10 — Human Use of NHI | Human review is no longer sufficient when agents act and delegate without it. | |
| Recommendation — Apply stronger authentication and context checks to internal agent handoffs before allowing downstream execution. Reduce agent and service-account privilege to the smallest task scope possible. Remove human-mediated assumptions from workflows where agents execute and delegate autonomously. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Undocumented internal endpoints and blind spots create an API security gap inside the mesh. |
| Recommendation — Inventory and secure internal APIs so east-west agent traffic is observable and governed. | ||
| MITRE ATT&CK | TA0008;TA0040 — Lateral Movement; Impact | The article describes internal pivoting through trusted calls followed by backend harm. |
| Recommendation — Map agent-to-agent pivot paths to lateral movement and contain high-value backend impacts. | ||
Key terms
- Agent To Agent Interaction: An agent to agent interaction is delegation between software entities, with context and instructions passing machine to machine. This creates a chain of decisions that can be difficult to trace or govern. Security teams must understand the sequence, not just the final output, to preserve accountability and auditability.
- East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
- Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
- Runtime Behavioural Governance: Controls that evaluate what an agent is actually doing while it is acting, rather than only what it was allowed to do at provisioning time. For enterprise AI agents, this is the layer that catches intent drift, context loss, and misaligned action execution.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org