PaperlayerView exact revision on arXiv

Source-linked AI summary

Building A Secure Agentic AI Application Leveraging A2A Protocol

Idan Habler, Ken Huang, Vineeth Sai Narajala, Prashant Kulkarni

arXiv:2504.16902v2cs.CRcs.AI

TL;DR

Autonomous agents collaborating across organizational and trust boundaries need secure, standardized communication, and A2A implementations face risks involving discovery, task execution, and authentication. The paper applies MAESTRO threat modeling to A2A and proposes security enhancements and implementation practices; it also describes historical approaches' credential-management and scaling challenges.

Abstract

from arXiv · show

As Agentic AI systems evolve from basic workflows to complex multi agent collaboration, robust protocols such as Google's Agent2Agent (A2A) become essential enablers. To foster secure adoption and ensure the reliability of these complex interactions, understanding the secure implementation of A2A is essential. This paper addresses this goal by providing a comprehensive security analysis centered on the A2A protocol. We examine its fundamental elements and operational dynamics, situating it within the framework of agent communication development. Utilizing the MAESTRO framework, specifically designed for AI risks, we apply proactive threat modeling to assess potential security issues in A2A deployments, focusing on aspects such as Agent Card management, task execution integrity, and authentication methodologies. Based on these insights, we recommend practical secure development methodologies and architectural best practices designed to build resilient and effective A2A systems. Our analysis also explores how the synergy between A2A and the Model Context Protocol (MCP) can further enhance secure interoperability. This paper equips developers and architects with the knowledge and practical guidance needed to confidently leverage the A2A protocol for building robust and secure next generation agentic applications.

I. INTRODUCTION

The paper situates A2A security within the growth of autonomous agents and prior agent-communication approaches, then uses MAESTRO to identify risks and propose security enhancements and implementation guidance.

A. The Rise of Agentic AI and the Need for Secure Interoperability

  • Agentic systems delegate tasks and collaborate across trust boundaries, making secure, standardized interoperability important to address impersonation, data exfiltration, and other risks.The paper offers secure A2A coding examples alongside its analysis.Source: A. The Rise of Agentic AI and the Need… · pp. 1–2

C. Paper Objectives: Analyzing A2A, Proposing Enhancements, and Guiding Secure Implementation

A. Agent to Agent Communication Literature Review

  • Agent-communication research spans ACLs such as KQML and FIPA ACL, varied architectures and applications, and open challenges in security, scaling, and integration with existing standards,,,.The review notes that A2A and MCP are pursuing protocol convergence, while how it may emerge remains unanswered.Source: A. Agent to Agent Communication… · p. 2

B. Traditional PKI and Transport Security

  • Historical PKI-based systems used certificates and TLS for encrypted communication, while JADE security extensions integrated PKI authentication.Certificate management could become complex as agent populations grew or changed dynamically.Source: B. Traditional PKI and Transport… · pp. 2–3

C. SOAP, WS-Security, and Enterprise Service Buses

  • WS-Security provided message-level encryption, signatures, and token authentication, but its verbose frameworks suited closed enterprises better than lightweight or real-time AI workflows.These approaches established principles of end-to-end confidentiality, integrity, and non-repudiation.Source: C. SOAP, WS-Security, and Enterprise… · p. 3

D. OAuth 2.0, JSON Web Tokens (JWT), and Service Accounts

F. Limitations of Historical Approaches

  • Historical approaches required manual credential work, adaptation of user-centric security to machine-only settings, inconsistent implementations, and increasingly complex secure communication as agent populations grew.The paper identifies a need for simpler, more automated credential exchange designed for autonomous agent interactions.Source: F. Limitations of Historical Approaches · p. 3

III. UNDERSTANDING GOOGLE’S A2A PROTOCOL

A2A defines client and remote-agent roles and a structured task flow using web standards. Agent Cards support discovery by publishing agent capabilities, endpoints, and authentication requirements.

A. Protocol Overview

  • A2A separates clients, which formulate and communicate tasks, from remote agents, which act on them; it uses HTTP, JSON-RPC, and SSE with integrated authentication and authorization.Its design emphasizes independent agents communicating explicitly without shared memory or tools by default.Source: A. Protocol Overview · p. 3

B. Communication Flow

  • Clients discover an agent through its HTTPS Agent Card, then authenticate as specified there and send JSON-RPC requests to its endpoint using tasks.send or tasks.sendSubscribe.The latter supports long-running tasks with streaming updates; the former supports tasks not requiring immediate streaming.Source: B. Communication Flow · p. 3
  • Tasks return a final Task object or stream status and artifact updates; they can request further input under the same taskId and end as completed, failed, or canceled.Servers may also send asynchronous updates to a registered webhook when push notifications are supported.Source: B. Communication Flow · pp. 3–4

1) AgentCard Structure:

  • The Agent Card is machine-readable JSON at /.well-known/agent.json, describing agent identity, endpoint, functions, capabilities, authentication methods, and hosted or DNS information.Its standardized location creates a predictable discovery pattern, and its JSON supports human readability and machine parsing.Source: 1) AgentCard Structure · p. 4

1) AgentCard:

This section defines A2A's principal entities and content units, then recaps MAESTRO as a seven-layer framework for proactive agentic-AI threat modeling.

1) AgentCard:

  • Agent Cards are public JSON metadata whose variable quality and accuracy affect discovery reliability and advertised security posture.They act as machine-readable business cards for agents.Source: 1) AgentCard · p. 4

2) A2A Server:

  • An A2A Server implements JSON-RPC methods at an HTTPS endpoint, receives requests, manages tasks, and returns responses or updates.A client consumes those services through JSON-RPC requests and can add or remove servers dynamically after launch.Source: 2) A2A Server · p. 4, 3) A2A Client · p. 4

4) Task:

  • A Task is the protocol's basic work unit, identified by a client-provided taskId and tracked through TaskStatus values.A2A supports both short request-response interactions and asynchronous tasks that may last days or weeks.Source: 4) Task · p. 4, • TASK_STATUS_FAILED · p. 4

5) Message:

  • A Message represents a dialogue turn with a user or agent role and one or more Parts.Parts can contain plain text, files, or structured JSON data.Source: 5) Message · p. 4, 6) Part · p. 4

6) Part:

  • Parts include TextPart for plain text, FilePart for inline Base64 bytes or a URI reference, and DataPart for structured JSON.DataPart identifies its content type with a mimeType.Source: 6) Part · p. 4

7) Artifact:

  • Artifacts represent agent-generated outputs during task execution, such as files, reports, or structured data, and contain Parts.Source: 7) Artifact · p. 4

A. Recap of MAESTRO Threat Modeling Methodology

  • MAESTRO is a seven-layer, proactive threat-modeling approach designed for agentic AI, extending established frameworks with AI-specific considerations.It prioritizes risks by likelihood and impact and emphasizes continuous monitoring and adaptation.Source: A. Recap of MAESTRO Threat Modeling… · pp. 4–5
  • MAESTRO spans foundation models, data operations, agent frameworks, infrastructure, evaluation and observability, security and compliance, and the agent ecosystem.Its layers reflect the view that security must be addressed throughout agentic architecture.Source: A. Recap of MAESTRO Threat Modeling… · pp. 4–5, Figure 1 · p. 5

B. Common A2A Multi-Agent System Threats

The MAESTRO-based threat analysis covers attacks on agent discovery, task execution, messages and artifacts, infrastructure, identity, and Agent Card content.

B. Common A2A Multi-Agent System Threats

  • MAESTRO threat modeling identifies risks across A2A multi-agent systems, including spoofing, replay, schema violations, impersonation, artifact attacks, supply-chain compromise, identity threats, and poisoned Agent Cards.The threats are illustrated in Figure 2 and detailed in the section.Source: B. Common A2A Multi-Agent System Threats · p. 5, Figure 2 · p. 6

1) Agent Card Spoofing:

  • A forged Agent Card at a malicious or typosquatting domain may divert discovery to a rogue server, enabling task hijacking, data exfiltration, or agent impersonation.Source: 1) Agent Card Spoofing · p. 5

2) A2A Task Replay:

4) A2A Server Impersonation:

5) Cross-Agent Task Escalation:

  • Attackers may intercept or modify artifacts exchanged during task execution, while privileged users or agents may manipulate task states or disable logging to conceal unauthorized actions.Source: 6) Artifact Tampering via A2A Artifacts · p. 5

8) Supply Chain Attack via A2A Dependencies:

10) Poisoned AgentCard:

  • Malicious instructions embedded in Agent Card fields may be processed during discovery and planning, potentially hijacking agent goals, revealing sensitive data, or bypassing security protocols.The analysis identifies validation and sanitization of Agent Card content as a needed response.Source: 10) Poisoned AgentCard · p. 5

C. Additional Security Considerations

The section lists cross-cutting security practices, then uses two A2A case studies to map threats, cross-layer vulnerabilities, and risk levels. It also emphasizes that threat modeling must be revisited as the A2A ecosystem changes.

C. Additional Security Considerations

  • Supply-chain verification, incident response, validated libraries, declarative infrastructure security, CI/CD security testing, and documented Agent Card capabilities and trust boundaries are recommended.The practices span dependency scanning, recovery planning, validation, authentication, monitoring, and unit, integration, and adversarial testing.Source: C. Additional Security Considerations · p. 6

V. CASE STUDY

  • The case studies are framed as a way to understand threat modeling for agentic systems.Source: §V · p. 6

A. Case Study 1: Collaborative Document Processing

  • The collaborative document case involves clients from different vendors discovering an enterprise server and launching tasks to co-edit, summarize, and review documents.The threat analysis spans prompt injection, data leakage or task tampering, card spoofing and replay, denial of service, weak auditing, credential theft, and fake-card attacks.Source: A. Case Study 1: Collaborative… · p. 6

1) Cross-Layer Vulnerabilities: •

B. Case Study 2: Distributed Data Analysis

  • The distributed analysis case has departmental clients send tasks to a central server and aggregate results through Artifacts, with threats spanning model inversion, poisoned data, replay, eavesdropping, and privacy violations.The analysis also identifies audit-log weaknesses, server compromise, Agent Card enumeration, and policy conflicts between federated servers.Source: B. Case Study 2: Distributed Data… · pp. 6–7
  • Poisoned Artifacts, weak task orchestration, and cross-department Agent Card trust failures are identified as cross-layer vulnerabilities in distributed analysis.The assessment rates likelihood medium-high and impact high, citing business intelligence compromise and regulatory risk.Source: B. Case Study 2: Distributed Data… · p. 7, 2) Risk Assessment · p. 7

C. Threat Evolution

  • The paper recommends regularly repeating MAESTRO threat modeling and updating identified threats as A2A protocols, Agent Card registries, and deployment patterns change.Source: C. Threat Evolution · p. 7

VI. MITIGATING SECURITY THREATS IN A2A-BASED MULTI-AGENT SYSTEMS

This section maps identified A2A threats to security controls, including protections for Agent Cards, tasks, messages, servers, and cross-agent access.

VI. MITIGATING SECURITY THREATS IN A2A-BASED MULTI-AGENT SYSTEMS

1) Addressing Agent Card Spoofing:

  • Forged Agent Cards can enable task hijacking, data exfiltration, and impersonation; proposed controls include signatures, secure resolution, trusted registries, reputation, and sanitization.Secure resolution includes HTTPS certificate validation and optionally certificate pinning.Source: 1) Addressing Agent Card Spoofing · p. 7

2) Preventing A2A Task Replay:

3) Preventing A2A Message Schema Violations:

4) Preventing A2A Server Impersonation :

5) Preventing Cross-Agent Task Escalation:

  • Cross-agent task escalation controls include strict authentication and authorization, per-task credential validation, audit logging, least privilege, and secure Agent Card discovery.Source: 5) Preventing Cross-Agent Task… · p. 7

6) Mitigating Artifact Tampering via A2A Artifacts:

The section recommends controls for artifact integrity, insider and logging risks, supply-chain security, authentication, and poisoned Agent Cards.

6) Mitigating Artifact Tampering via A2A Artifacts:

7) Preventing Insider Threat/Logging Evasion via A2A Task Manipulation:

8) Addressing Supply Chain Attacks via A2A Dependencies:

9) Mitigating Authentication & Identity Threats:

  • Authentication and identity controls include strong JWT validation, secure token storage and rotation, mTLS for API access, and OAuth 2.0 practices including PKCE.Source: 9) Mitigating Authentication &… · p. 8

10) Mitigating Poisoned AgentCard:

B. Additional Security Considerations

The section combines operational safeguards, case-specific mitigation examples, current-feature implementation guidance, and potential future security enhancements for A2A.

B. Additional Security Considerations

  • Additional operational practices include continuous dependency verification, incident response planning, open-source library review, declarative security configuration, CI/CD testing, and documenting Agent Card capabilities and trust boundaries.Source: B. Additional Security Considerations · p. 8

C. Applying Mitigations to Case Studies (Sections V-A and V-B)

  • For collaborative document processing, the listed mitigations include sanitizing Agent Cards, auditing artifact aggregation, signing documents, granular access control, and data-loss prevention.Source: C. Applying Mitigations to Case… · p. 8
  • For distributed data analysis, the listed measures include Agent Card sanitization, task validation and authentication, differential privacy, federated learning, and secure multi-party computation.Source: C. Applying Mitigations to Case… · p. 8

A. Securely Implementing with Current A2A Features

B. Leveraging Enhanced A2A Features for Advanced Security

VIII. KEY CONTROL MEASURES FOR SAFE A2A DEPLOYMENT

  • Key deployment controls include TLS and network security, strong authentication and authorization, input validation, least privilege, monitoring and logging, secure development practices, and incident response.Source: §VIII · p. 8

IX. IMPLEMENTING A2A SERVER SECURELY

The section recommends controls for protecting A2A server deployments, from securing AgentCards and enforcing authentication and authorization to protecting communications in transit and at rest.

IX. IMPLEMENTING A2A SERVER SECURELY

  • The section presents its controls as measures to improve resilience against potential threats and points to Fig. 3 for a high-level threat overview.The figure caption identifies it as best practices for a secured A2A server.Source: §IX · p. 8, Figure 3 · p. 9

A. Securing the AgentCard

  • AgentCards expose an agent’s capabilities and authentication requirements, so the paper treats them as a security-relevant part of A2A deployment.The AgentCard is located at /.well-known/agent.json.Source: A. Securing the AgentCard · p. 8

B. Securing the AgentCard

  • AgentCard safeguards include rate limiting access, limiting disclosed capabilities, specifying authentication requirements, and regularly checking content and authentication details.The recommendations also include content security headers and suitable access controls.Source: B. Securing the AgentCard · p. 8

C. Authentication and Authorization •

  • Authenticate server identity with trusted certificates and TLS, declare supported methods in the Agent Card, and authenticate each incoming request.The recommendations also call for JWT signature validation, appropriate expiration, and limiting claims.Source: C. Authentication and Authorization • · pp. 8–9
  • Authorize access to skills and tools separately, and protect API keys with strong generation, rotation, and secure storage practices.Skill permissions can use specific scopes, including read-only access.Source: C. Authentication and Authorization • · p. 9

D. Secure Communication

  • Protect A2A communications with HTTPS and TLS, validate certificate chains, encrypt sensitive stored data, and manage encryption keys securely.The recommendations specify TLS 1.3 and renewing certificates while disabling insecure ciphers.Source: D. Secure Communication · p. 9

E. Input Validation and Request Processing

The recommendations cover input and file validation, secure server operations, and safeguards for streaming and push-notification features.

E. Input Validation and Request Processing

  • Validate A2A messages against the protocol schema, sanitize inputs, and check message formats, sizes, content types, and included URIs before processing.URI allow-lists and avoiding untrusted or user-supplied URI fetches are recommended to reduce SSRF risk.Source: E. Input Validation and Request… · p. 9

F. Server Implementation Best Practices

  • Server practices include limiting sensitive error details, protecting security logs from tampering, monitoring suspicious activity, and rate-limiting endpoints.The section also recommends code reviews, security testing, and keeping dependencies updated.Source: F. Server Implementation Best Practices · pp. 9–10

G. Protocol-Specific Security Considerations

  • For streaming, secure SSE authentication and state, and manage connections with quotas, timeouts, keep-alive checks, and backpressure; validate webhook URLs and signatures.The recommendations also include HTTPS for webhook communication and retry policies with backoff.Source: G. Protocol-Specific Security… · p. 10

H. Server Hardening

The section combines server-hardening recommendations with an account of how A2A and MCP work together, the security risks at their integration boundaries, and future directions for secure agent collaboration.

H. Server Hardening

  • Harden A2A deployments with network segmentation, a web application firewall, updates, monitoring, incident-response procedures, and regular security assessments.The section also recommends penetration tests and an incident-management process.Source: H. Server Hardening · p. 10

X. MCP AND A2A: A SYNERGY

  • A2A supports peer-agent coordination while MCP connects agents to specialized tools and data; together they support a hierarchical workflow that returns delegated work through A2A.The described workflow has an agent discover and delegate tasks to specialized agents, which use MCP for data sources, tools, or external systems.Source: §X · p. 10, Figure 4 · p. 11
  • The combined architecture supports modular specialized agents, flexible agent combinations, separation of coordination from resource access, and incremental capability additions.These are stated design principles of the architecture.Source: §X · pp. 10, 12
  • Integration creates cross-protocol attack paths: A2A authentication weaknesses may expose MCP access, while inadequately protected MCP data may enable later A2A compromise.The paper calls for security controls across both protocols and their interfaces, including token handling, delegation permissions, and data transmission.Source: §X · p. 12

A. Recap of A2A’s Role, Security Challenges, and Enhancement Potential

  • A2A standardizes agent discovery, authentication, and communication, but distributed multi-agent systems also face threats such as prompt injection into AgentCards and cross-agent escalation.The recap calls for context-aware threat modeling and security controls in both protocol design and server implementation.Source: A. Recap of A2A’s Role, Security… · p. 12

B. Future Directions for Secure Agent Collaboration

  • Future work includes standardized complex authorization policies, agent identity and reputation mechanisms, secure coordination across trust boundaries, and protection for LLM-integrated workflows.The paper also identifies multimodal communication, structured networks, and shared implementation guidelines as future concerns.Source: B. Future Directions for Secure Agent… · p. 12
Loading 2504.16902v2…