How do teams detect unsafe agent-to-agent behaviour?

What unsafe agent-to-agent behaviour looks like in practice

Unsafe agent-to-agent behaviour is usually visible as a sequence problem, not a single bad action. Teams should look for one agent making requests that do not fit its normal job, such as reaching systems it rarely touches, repeating a call pattern that is not part of its usual workflow, or escalating into a target with no clear business reason.

That framing matters because a harmful action can still be a legitimate operation. A database read, refund approval, or escalation request may be valid on its own, but unsafe when it appears in the wrong context, at the wrong time, or from the wrong peer-to-peer relationship.

Which signals are most useful for detection

The strongest detection signals are behavioural: target, timing, and sequence. Teams should baseline which agents normally talk to which other agents, what downstream systems they contact, how often those exchanges happen, and whether the call chain is short and stable or broad and opportunistic.

Look for deviations such as off-hours coordination, abrupt changes in call volume, new or unusual recipients, and requests that bypass the normal path of handoffs. These are often easier to detect than content-based indicators because the message may look routine while the surrounding behaviour is not.

Multi-Agent and A2A Security Guide is useful here because it focuses on inter-agent communication, delegation chains, and containment, which are the patterns most likely to drift before the final harmful action appears.

AI Agent Observability, Audit and Incident Response Guide is also relevant when teams need to attribute which agent made which call and how to spot anomalies in the action trail.

RFC 8693: OAuth 2.0 Token Exchange matters where agent-to-agent delegation is implemented with token exchange, because tracing delegated authority helps explain why one agent was able to act on behalf of another.

How teams should turn detection into a working control

Detection works best when it combines baselines, attribution, and policy checkpoints. Behavioural baselines tell you what is normal, but they need supporting telemetry so teams can see which principal initiated the action, which peer agent relayed it, and whether the request crossed an approved boundary.

Teams should prefer per-action evaluation over blanket trust for all agent relationships, especially when one agent can trigger expensive, irreversible, or externally visible outcomes. That is the point at which unsafe behaviour stops being merely unusual and becomes operationally material.

AI Agent Authorisation Guide helps operationalise that model by applying task-scoped access, just-in-time authority, and per-action policy decisions.

Zero Trust for AI Agents is a strong fit when teams need to verify the agent, the principal, and the request instead of assuming trust across the mesh.

OWASP Agentic Skills Top 10 is a useful companion where unsafe behaviour emerges through chained skills and inherited permissions rather than a single direct call.

Risk and Threat Considerations

Unsafe agent-to-agent behaviour can create rapid blast-radius expansion because one compromised or over-permissive agent may influence many others before humans notice the deviation. The main danger is not only malicious use, but also accidental misuse of valid authority across an unexpected peer relationship.

Failure mechanism: An agent inherits trust from a peer, then uses that trust to pull data, approve actions, or escalate requests outside its intended scope. That pattern is especially hard to catch when the action itself looks legitimate in isolation.

Impact: Teams can get silent data exposure, wrongful approvals, cascading automation errors, or multi-agent compromise that spreads faster than a human review process can contain.

Practitioner Guidance

What to prioritise: Start by mapping which agent-to-agent exchanges are allowed to trigger state-changing actions, then baseline the normal sequence, frequency, and target systems for each of those exchanges. The highest-value detections are usually the ones tied to actions that can spend money, move data, or change permissions.

What to verify: Confirm that every high-impact peer call can be attributed to a specific initiating principal and that off-pattern calls are reviewable with enough context to explain why the request was allowed. If you cannot reconstruct that chain, your detection is too weak to trust.

Common mistake: Treating content filters or signature alerts as sufficient. Unsafe agent-to-agent behaviour often survives content checks because the request text is ordinary; the anomaly is in the relationship, timing, and sequence.

Practitioner takeaway: The best detector is not the one that recognises the most bad phrases, it is the one that can tell when a valid action is happening in an invalid peer-to-peer context.

Related resources from NHI Mgmt Group

• How should security teams detect risky AI agent behaviour in production?
• How do security teams detect unsafe shared memory in agent workflows?
• How can security teams detect whether an AI agent is inheriting unsafe instructions?
• How can security teams detect unsafe agent skills before they spread?