Agent-to-agent communication security: A2A, MCP, and hidden channels
How to secure communication between AI agents over protocols like A2A and MCP — and why protocol security alone misses indirect channels through shared infrastructure.
Agent-to-agent communication security protects the messages, delegations, and shared resources through which AI agents influence each other. It requires authenticated and logged protocol channels such as the Agent2Agent (A2A) protocol and the Model Context Protocol (MCP), plus visibility into indirect channels — files, caches, repositories, and memory — that carry information between agents without any explicit message.
Explicit channels: protocols
Protocols such as A2A, for agent-to-agent delegation, and MCP, for connecting agents to tools and context, make agent interactions standard and observable. That is good for security, provided every hop is authenticated, authorised, and logged.
- Mutual authentication between agents and servers.
- Signed or integrity-protected messages and task delegations.
- Scoped, short-lived credentials for every delegated task.
- Allow-lists for which agents and tools may talk to which.
- Centralised logs that preserve who asked whom to do what.
Implicit channels: everything else
Agents also influence each other without any protocol message: one writes a file, updates a cache, commits to a repository, or stores a memory that another later reads. OWASP's ASI07 covers insecure inter-agent communication, but these indirect channels rarely appear in protocol logs at all.
Securing the protocol therefore secures only part of the communication graph. The rest must be reconstructed from infrastructure evidence.
Reconstructing the full communication graph
Inwom combines explicit interactions with resource-level evidence to reconstruct candidate communication paths across a population, distinguishing ordinary co-access from changes that measurably influenced another agent's behavior. Inferred communication remains labelled as inferred.
Questions people ask
Is MCP secure?
MCP defines how agents connect to tools and context; its security depends on implementation — authentication, authorization, server provenance, and logging. Even a well-secured MCP deployment does not cover indirect communication between agents through shared resources.
What is the difference between A2A and MCP?
MCP (Model Context Protocol) standardises how an agent connects to tools, data, and context. A2A (Agent2Agent) standardises how agents discover and delegate tasks to other agents. Both create channels that need authentication, authorization, and monitoring.
Primary references
These sources define the broader agentic-AI security landscape. Inwom’s population-level detection model is its own product and research direction; these organizations do not endorse Inwom.
- NIST — Agentic AIResearch, standards, evaluation, interoperability, and risk management for agentic AI.
- MITRE ATLAS — Threat Matrix for AI SystemsA living knowledge base of adversary tactics and techniques involving AI systems.
- OWASP — Top 10 for Agentic Applications 2026A threat-focused framework for autonomous and agentic applications.