A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures

Dezhang Kong; Shi Lin; Zhenhua Xu; Zhebo Wang; Minghao Li; Yufeng Li; Yilun Zhang; Hujin Peng; Xiang Chen; Zeyang Sha; Yuyuan Li; Changting Lin; Xun Wang; Xuan Liu; Ningyu Zhang; Chaochao Chen; Chunming Wu; Muhammad Khurram Khan; Meng Han

Source-linked AI summary

A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures

Dezhang Kong, Shi Lin, Zhenhua Xu, Zhebo Wang, Minghao Li, Yufeng Li, Yilun Zhang, Hujin Peng, Xiang Chen, Zeyang Sha, Yuyuan Li, Changting Lin, Xun Wang, Xuan Liu, Ningyu Zhang, Chaochao Chen, Chunming Wu, Muhammad Khurram Khan, Meng Han

arXiv:2506.19676v4Jun 24, 2025cs.CR

TL;DR

As agents communicate with other agents and tools, their expanded real-world capabilities create security risks that existing LLM-focused research does not fully address. This survey defines and classifies agent communication, analyzes protocols, risks, and defenses across three layers, and demonstrates attacks against MCP and A2A, including command execution, file deletion, and key exfiltration.

Problem
Agent communication introduces security hazards because tool-enabled agents can cause substantial real-world damage and expose aggregated personal information.
Method
The paper defines and classifies agent communication, maps protocols and risks across three communication layers, surveys defenses, and experiments with MCP and A2A attacks.
Results
Experiments successfully induced Claude to execute embedded malicious commands, exfiltrate SSH keys, and delete a file through manipulated tool descriptions or retrieved documents.
Takeaways & Limitations
The survey provides a framework for evaluating agent communication security and identifies technical and legal open issues for future research.
Takeaways & Limitations
The semantic interpretation layer lacks dedicated communication protocols despite remaining an important attack surface.

Abstract

from arXiv · show

In recent years, Large-Language-Model-driven AI agents have exhibited unprecedented intelligence and adaptability. Nowadays, agents are undergoing a new round of evolution. They no longer act as an isolated island like LLMs. Instead, they start to communicate with diverse external entities, such as other agents and tools, to perform complex tasks. Under this trend, agent communication is regarded as a foundational pillar of the next communication era, and many organizations have intensively begun to design related communication protocols (e.g., Anthropic's MCP and Google's A2A) within the past year. However, this new field exposes significant security hazards, which can cause severe damage to real-world scenarios. To help researchers quickly figure out this promising topic and benefit the future agent communication development, this paper presents a comprehensive survey of agent communication security. More precisely, we present the first clear definition of agent communication. Besides, we propose a framework that categorizes agent communication into three classes and uses a three-layered communication architecture to illustrate how each class works. Next, for each communication class, we dissect related communication protocols and analyze the security risks, illustrating which communication layer the risks arise from. Then, we provide an outlook on the possible defense countermeasures for each risk. In addition, we conduct experiments using MCP and A2A to help readers better understand the novel vulnerabilities brought by agent communication. Finally, we discuss open issues and future directions in this promising research field. We also publish a repository that maintains a list of related papers on https://github.com/theshi-1128/awesome-agent-communication-security.

I. INTRODUCTION … B. Selection Principles of the Most Relevant Surveys

This survey defines and structures LLM-driven agent communication, reviews its protocols, risks, and defenses, and validates attack surfaces through MCP and A2A experiments. It selects related surveys using criteria centered on LLM-driven agents, communication, and security.

I. INTRODUCTION: LLM-driven agents extend beyond isolated LLMs by integrating perception, interaction, reasoning, and execution to complete real-world tasks.
I. INTRODUCTION: Agent communication connects agents with external entities, but cross-organization interaction expands attack surfaces to privacy leakage, spoofing, bullying, and denial-of-service attacks.
I. INTRODUCTION: The survey introduces a first definition, three communication classes, and a three-layer architecture that clarifies communication functions across the lifecycle.
II. RELATED WORK: It reviews 19 agent communication protocols, categorizes them by characteristics, and organizes the survey around protocols, risks, defenses, experiments, and future directions.
A. Overview of Novelties in This Survey: Experiments against MCP and A2A show that attackers can cause severe damage with little effort, clarifying the new attack surfaces introduced by agent communication.
A. Overview of Novelties in This Survey: The survey categorizes discovered attacks and potential risks by communication layer and outlines countermeasures covering the full agent communication lifecycle.
B. Selection Principles of the Most Relevant Surveys: Survey selection requires LLM-driven agents, while communication and security are the other criteria; surveys satisfying any two criteria are included.
B. Selection Principles of the Most Relevant Surveys: Relevant surveys are grouped as LLM-driven agents plus communication or security, and assigned subjective relevance scores rather than objectively calculated scores.

C. Detailed Comparison with the Most Relevant Surveys … 4) Agent Communication Era:

The paper contrasts prior surveys’ limited coverage of agent communication security with its broader scope, while situating agent communication as the fourth stage in communication evolution. This stage shifts from device interconnection toward collaboration among autonomous LLM-driven entities.

C. Detailed Comparison with the Most Relevant Surveys: Prior surveys variously omit clear definitions, communication protocols, security analyses, or comprehensive defenses for agent communication.Survey [175] only partially discusses user-agent interaction risks; [315] omits protocols and sufficiently analyzes A-A and A-E; [351] lacks several protocols, threat analysis, and broad defenses.
III. PRELIMINARY: THE EVOLUTION OF COMMUNICATION AND AGENTS: The paper reviews the entire lifetime of communication and LLM-driven AI agents.
A. The Evolution of Communication: Communication technology evolves through computer, mobile, IoT, and agent communication stages with technological inheritance, enhanced capabilities, and expanded applications.Each stage lays the foundation for the next while integrating earlier technological advantages.
1) Computer Communication Era:: The computer communication era connected fixed devices through dedicated lines and later TCP/IP, enabling remote transmission across device types.Its core value was establishing standard communication protocols and reducing information barriers.
2) Mobile Communication Era:: The mobile communication era expanded interaction from fixed computers to moving people and devices through mobile technologies and intelligent terminals.Its defining features include portable mobile terminals and communication that is no longer constrained by time and space.
3) IoT Communication Era:: The IoT communication era connected diverse devices for real-time physical-world perception through customized protocols.Communication shifted from human-computer interaction toward environmental perception and thing-to-thing connectivity.
4) Agent Communication Era:: The agent communication era involves LLM-driven agents with autonomous perception, memory, reasoning, decision-making, and tool-use capabilities collaborating as intelligent entities.This represents a qualitative leap from device interconnection, with communication goals extending beyond simple data transmission.

B. LLM-Driven AI Agents … 3) Comparison Between Agents and LLMs:

LLMs provide broad language, reasoning, coding, and translation capabilities, while LLM-driven agents extend them with modular perception, memory, tools, reasoning, and action to complete specialized tasks. This architecture gives agents greater autonomy, multimodal interaction, tool use, adaptability, collaboration, and hallucination inhibition, but also worse security because their actions can damage the real world.

1) Large Language Model:: LLMs are trained on large-scale text corpora and support language understanding, generation, reasoning, code generation, and translation.
2) LLM-Driven AI Agents:: LLM-driven agents are designed for specialized tasks rather than chatbot interaction and typically combine perception, memory, tools, reasoning, and action modules.Perception connects agents to domain-specific environments, while memory stores instructions, knowledge, interaction history, and other future-use data.
2) LLM-Driven AI Agents:: The reasoning module decomposes instructions, selects plans, and revises strategies from environmental feedback, while the action module converts decisions into executable operations.Structured output control helps ensure that completed action descriptions do not produce redundant output that interferes with parsing.
2) LLM-Driven AI Agents:: By integrating these modules, agents form a perception-decision-action-feedback closed loop for automatically completing domain-specific tasks.
3) Comparison Between Agents and LLMs:: Compared with LLMs, agents offer higher autonomy, flexible multimodal interaction, richer tool invocation, better hallucination inhibition, dynamic adaptability, and stronger collaboration.Agents can decompose tasks, invoke and combine tools, use RAG or external information, respond to real-time environments, and coordinate through MCP or A2A.
3) Comparison Between Agents and LLMs:: Agents dynamically adapt through online search, database queries, real-time sensors, and multi-agent collaboration, whereas LLM knowledge remains fixed after training.MCP provides unified external-tool integration, and A2A enables agents from different enterprises to cooperatively complete tasks.
3) Comparison Between Agents and LLMs:: Agents have worse security than LLMs because tool invocation can enable malicious or erroneous operations that substantially damage machines, databases, and systems.LLMs mainly output text, limiting the direct real-world influence of illegal or discriminatory content.

4) Agent Applications: … C. Three Agent Communication Classes

Agents are rapidly expanding across scientific, engineering, and public-service domains, while agent communication enables task-driven information exchange and coordination among agents, users, tools, and other external entities. The paper classifies this communication into three object-based classes supported by three functional layers.

4) Agent Applications:: Agents are increasingly used in scientific research across mathematics, chemistry, biological sciences, and materials science.
4) Agent Applications:: Engineering applications include code generation, bug localization, verification, system configuration, game development, simulation, and embodied intelligence.
4) Agent Applications:: Agents support public services through legal document work and applications in finance, education, and healthcare.
4) Agent Applications:: The agent market is estimated to grow 40% annually and exceed 216.8 billion dollars by 2035.
C. Takeaways: Agents are evolving toward specialized professional skills in narrow domains rather than comprehensive capabilities like LLMs.
A. Agent Communication Definition: Agent communication is task-driven and involves multimodal information exchange and dynamic behavior coordination through standardized protocols before returning results to users.It is demanded to overcome the capability limitations of a single agent.
A. Agent Communication Definition: Agent communication requires that at least one communication object be an agent, whether the other object is a tool, user, or another agent.
B. Agent Communication Classification: The framework distinguishes user-agent interaction, agent-agent communication, and agent-environment communication across data transmission, interaction protocol, and semantic interpretation layers.User-agent interaction is especially vulnerable to prompt-engineering manipulation because it is naturally multimodal.

1) User-Agent Interaction: … E. Organization of the Following Sections

The paper distinguishes user-agent interaction, agent-agent communication, and agent-environment communication by entity types, then explains them through a three-layer architecture. The architecture separates transmission, interaction protocols, and semantic interpretation to organize security analysis and locate vulnerabilities.

1) User-Agent Interaction:: User-agent interaction is treated as interaction rather than communication because LLMs are involved.
2) Agent-Agent Communication:: Agent-agent communication enables negotiation, task decomposition, sub-task allocation, and result aggregation through standardized collaboration protocols.
3) Agent-Environment Communication:: Agent-environment communication connects agents with tools, knowledge databases, and other external resources through standardized protocols to complete user tasks.Examples include querying Beijing weather online and searching tourist spots through databases or online blogs.
3) Agent-Environment Communication:: Classifying communication by entity type clusters vulnerability types and defenses according to differentiated capabilities and attack surfaces.User-agent interaction is especially exposed to the natural uncontrollability of user input.
D. A Three-Layer Communication Support: The three-layer architecture clarifies otherwise unclear underground communication details and shows how the classes support agent communication.
1) L1: Data Transmission Layer:: L1 handles data transmission through TCP/IP or custom protocols, with remote-agent communication potentially built on HTTPS.
2) L2: Interaction Protocol Layer:: L2 defines communication modes and pre-transmission principles, including authentication, session management, and authorization.
3) L3: Semantic Interpretation Layer:: L3 semantically interprets multimodal messages for reasoning, planning, and reflection, but lacks dedicated protocols because it relies on LLM understanding and remains an attack surface.The layered framework separates functionality and security, helping locate failures such as MITM at L1 and prompt injection at the semantic layer.

F. Takeaways … 1) Risks from Data Transmission Layer (L1):

The survey defines agent communication, classifies it by communication objects, and models it with three layers to organize protocol, risk, and defense analysis. In user-agent interaction, L1 risks affect confidentiality, integrity, and availability, while the most distinctive threats arise from semantic intent at L3.

F. Takeaways: The survey defines agent communication, classifies it into three classes by communication objects, and proposes a three-layer architecture as a foundation for security analysis.The framework groups scenarios with similar vulnerability characteristics and supports analysis of protocols, risks, and countermeasures.
V. USER-AGENT INTERACTION: User clients typically locate remote agent servers through DNS and establish HTTPS connections, relying on mature networking stacks rather than novel transport mechanisms.Newly proposed user-agent interaction protocols primarily concern L2.
A. Interaction Protocols: AG-UI uses a client-server, event-driven architecture with typed lifecycle, text-message, tool-call, and state-management events for user-agent communication.Its client subscribes to event streams and agents can transfer context to preserve conversational continuity.
A. Interaction Protocols: PXP introduces two-way intelligibility for human-expert and agent interaction, while Spatial Population Protocol supports pairwise distance or relative-position exchange in robot systems.Neither protocol was designed specifically for LLM-driven agents, but both may inform agent communication design.
B. Security Risks: Threats distribute across all three layers, but L3 predominates because semantic intent validation conflicts with instruction-following and is not addressed by traditional security mechanisms.L1 and L2 threats are common across systems and are often mitigated with standard cryptographic and authentication methods.
1) Risks from Data Transmission Layer (L1):: L1 confidentiality risks include eavesdropping on insecure channels and traffic analysis that infers interaction details, agent types, counts, or scale from encrypted traffic patterns.Observed timing, packet size, and frequency can reveal sensitive information even when message contents remain encrypted.
1) Risks from Data Transmission Layer (L1):: L1 integrity risks include MITM modification and replay of valid packets, while availability risks include volumetric DoS floods that block legitimate requests.Examples include replacing benign requests with malicious prompts, duplicating financial commands, and saturating network bandwidth.

2) Risks from Interaction Protocol Layer (L2): · 3) Risks from Semantic Interpretation Layer (L3):

Interaction-protocol risks arise when authentication, session-state, or context-passing mechanisms are flawed, enabling identity takeover, state corruption, or privilege escalation. Semantic-layer risks arise from deceptive text, multimodal inputs, compromised agents, and malicious outputs that enable privacy violations, manipulation, harmful execution, or resource exhaustion.

2) Risks from Interaction Protocol Layer (L2):: L2 risks exploit protocol design or implementation weaknesses in authentication, session management, and context passing while remaining within formal protocol constraints.These weaknesses can subvert security goals without necessarily violating the protocol’s apparent rules.
2) Risks from Interaction Protocol Layer (L2):: Identity spoofing uses compromised credentials to establish fraudulent sessions, seize a victim’s identity, and control the agent’s memory and capabilities.Attackers can then initiate malicious long-lived event streams for unauthorized actions and sensitive-data exfiltration.
2) Risks from Interaction Protocol Layer (L2):: Session manipulation sends validly typed but logically inconsistent events that corrupt internal state when server-side state-transition validation is insufficient.The resulting failure can desynchronize client-side state from the agent’s backend.
2) Risks from Interaction Protocol Layer (L2):: Authority abuse exploits context passing across agents to escalate privileges when a receiving agent fails to verify consistency with the user’s original authorization scope.This abuse circumvents the security boundaries of the original user session.
3) Risks from Semantic Interpretation Layer (L3):: L3 semantic risks stem from insecure contents, including stealthy text attacks, prompt injection, jailbreaks, privacy leakage, and cognitive exhaustion.Prompt injection can be direct or indirect, while jailbreaks use techniques such as multi-turn reasoning, role-playing, or obfuscation to bypass safety constraints.
3) Risks from Semantic Interpretation Layer (L3):: Multimodal attacks hide malicious intent in images or audio, bypassing text-oriented safeguards through visual manipulation, adversarial perturbations, synthesized speech, or unintended command injection.The passages identify modality-aware defenses requiring perceptual robustness, cross-modal consistency verification, and adversarial detection.
3) Risks from Semantic Interpretation Layer (L3):: Compromised agents can violate user privacy by leaking PII, financial data, or conversation history and by inferring sensitive behavioral or psychological attributes.They can also exploit user trust to shape beliefs, manipulate decisions and relationships, and impersonate users convincingly using learned communication styles.
3) Risks from Semantic Interpretation Layer (L3):: Compromised agents can execute malicious tasks by introducing economic or professional harm, generating phishing or malware-related guidance, and supplying dangerous instructions affecting physical or financial safety.The described harms include flawed code or financial projections, confidential-strategy leakage, phishing, malware delivery, toxic-substance synthesis, malicious code, and unsafe medical or financial advice.

C. Defense Countermeasure Prospect … 3) Defenses on Semantic Interpretation Layer (L3):

The paper proposes layered defenses for agent communication, spanning encrypted and obfuscated transmission, authenticated and state-integrity-preserving protocols, and semantic safeguards against malicious users and agents. At the semantic layer, defenses combine filtering, source evaluation, metadata isolation, resource regulation, multimodal consistency checks, privacy protection, and behavior restrictions.

C. Defense Countermeasure Prospect: The paper investigates defense measures addressing security risks in user-agent interaction.
1) Defenses on Data Transmission Layer (L1):: L1 defenses should use HTTPS, end-to-end encryption, and traffic obfuscation with dynamically adjusted packet lengths and random padding.
2) Defenses on Interaction Protocol Layer (L2):: L2 defenses should combine robust identity authentication, strict protocol-state integrity, and zero-trust authorization.Device-bound certificates, continuous authentication, and real-time verification help limit spoofing and hijacking, while server-side state-transition enforcement addresses session manipulation.
3) Defenses on Semantic Interpretation Layer (L3):: L3 defenses against text-based attacks combine input/output filtering, external-source evaluation, internal metadata isolation, and cognitive-load regulation.These measures address malicious instructions, indirect prompt injection, prompt-based privacy extraction, exhaustion attacks, and unnecessary reasoning loops.
3) Defenses on Semantic Interpretation Layer (L3):: Multimodal defenses should purify images and audio and verify cross-modal semantic consistency before processing requests.Image transformations, audio signal processing, and independent alignment or captioning models can disrupt adversarial signals and detect conflicts across modalities.
3) Defenses on Semantic Interpretation Layer (L3):: Against malicious-agent privacy violations, proposed defenses include data minimization, anonymization, privacy-leakage prompt detection, and cross-modal inference restriction.Sensitive biometric data can use differential privacy or k-anonymity, while modality isolation, noise, feature disentanglement, and dynamic masking reduce identity reconstruction and inference risks.
3) Defenses on Semantic Interpretation Layer (L3):: Behavior auditing and restrictions should counter manipulation risks in agent-to-user interactions by limiting persuasive personalization.

D. Takeaways · A. Communication Protocols

The paper organizes agent-agent communication by how agents are discovered, distinguishing client-server, peer-to-peer, and hybrid protocols, while emphasizing layered defenses for secure interaction. Existing protocols vary in discovery mechanisms, identity support, communication modes, and state management.

D. Takeaways: Three-layered defenses secure user-agent interaction by protecting network traffic, identities and sessions, and higher-level risks.L1 uses HTTPS encryption and traffic obfuscation; L2 requires authentication and session-state verification to prevent identity spoofing and privilege abuse.
A. Communication Protocols: Agent-agent communication consists of discovery and communication phases, with existing protocols differing more in discovery than in task assignment and completion.Discovery identifies agents matching capability requirements, whereas communication assigns and completes tasks.
A. Communication Protocols: Client-server protocols centralize agent information and provide stronger discovery through interfaces managed by centralized servers.They can manage unique IDs and capability descriptions and let agents discover desired peers through server-mediated interactions.
A. Communication Protocols: Protocols such as ACP-IBM, ACP-AGNTCY, ANP, LOKA, LMOS, and A2A implement varied discovery, identity, interoperability, and state-management mechanisms.Examples include capability descriptions, DIDs and verifiable credentials, registry or DNS-based discovery, and standardized Agent Cards.
A. Communication Protocols: Peer-to-peer protocols decentralize discovery through globally universal identifiers, enabling convenient Internet-wide location and search but usually not capability-based discovery.ACN uses a DHT to publish and discover public keys for encrypted point-to-point channels.
A. Communication Protocols: Hybrid protocols combine client-server and peer-to-peer discovery according to scenario, commonly using centralized discovery locally and decentralized discovery worldwide.This flexibility does not completely eliminate the limitations of either discovery paradigm.
A. Communication Protocols: Other protocols prioritize communication-process design rather than distinct discovery architectures, including formats, query management, negotiation, and historical conversational state.Agora dynamically switches between standardized protocols and hash-identified Protocol Documents, while AITP and Agent Protocol use thread-based state structures.

B. Security Risks · 1) Risks from Data Transmission Layer (L1):

The section analyzes structural security risks in agent-agent communication, emphasizing threats arising across communication modes and the distinct consequences of centralized and peer-to-peer architectures. It identifies universal L1 risks, controller-focused threats in CS-based communication, and monitoring limitations in P2P communication.

B. Security Risks: The analysis prioritizes structural risks likely to affect related communication protocols rather than minor design flaws in existing protocols.The authors frame this focus as useful for evaluating existing protocols and guiding future development.
1) Risks from Data Transmission Layer (L1):: Some agent-agent threats share causes and effects with user-agent interaction, so the section presents only effects unique to agent-agent communication.This scope distinction applies to the risks discussed in the data transmission layer.
1) Risks from Data Transmission Layer (L1):: Multi-agent architectures can enable large-scale traffic analysis that reverse-engineers system modes, architecture, and user habits.Data tampering and denial-of-service impacts can also be magnified by multi-agent architectures, although the supplied passage is truncated.
1) Risks from Data Transmission Layer (L1):: CS-based communication faces centralized-architecture risks because its controller routes and forwards all inter-agent message flows.The centralized controller is therefore the structural focal point of security risk in this communication mode.
1) Risks from Data Transmission Layer (L1):: A compromised CS controller can amplify attacks across all agents it manages, making the centralized server an attractive target despite limited prior research on this risk.The passage relates this concern to evidence from centralized server and controller security research in other areas.
1) Risks from Data Transmission Layer (L1):: P2P communication lacks centralized control for monitoring and managing message contents, leaving it exposed to confidentiality, integrity, and availability violations.The passage characterizes these as risks also found in user-agent interaction.

2) Risks from Interaction Protocol Layer (L2): … 2) Defenses on Interaction Protocol Layer (L2):

The paper organizes agent-communication security around protocol-layer risks and corresponding defenses, covering universal, client–server, and peer-to-peer settings. It identifies interaction, semantic, and transmission-layer vulnerabilities, then proposes authentication, verification, monitoring, balancing, search, and lifecycle controls.

2) Risks from Interaction Protocol Layer (L2):: Interaction-protocol threats exploit agent registration and discovery to manipulate operational logic, including spoofing, registration pollution, and peer-to-peer non-convergence.Spoofed agents can intercept data, inject instructions, or induce dangerous operations; polluted registries can invoke forged agents; decentralized protocols struggle to guarantee task termination.
3) Risks from Semantic Interpretation Layer (L3):: Semantic-layer risks arise when agent messages or metadata distort interpretation, causing cross-agent pollution, centralized task manipulation, or cognitive and ethical drift.Compromised agents can propagate false information and disruptive responses, while compromised client–server orchestrators can rewrite task intent or safety constraints.
C. Defense Countermeasure Prospect: The defense outlook targets risks across universal, client–server, and peer-to-peer communication protocols through countermeasures tailored to each communication category.The paper presents these measures to motivate future agent-communication security design and deployment.
1) Defenses on Data Transmission Layer (L1):: Transmission-layer defenses reuse countermeasures from user–agent communication for universal and peer-to-peer risks, while client–server systems require controller isolation and enhancement.Controller messages should be authenticated, integrity-checked, and rate-limited, and the controller should run in an isolated, hardened environment.
2) Defenses on Interaction Protocol Layer (L2):: For universal interaction-protocol risks, identity authentication should be paired with capability verification to defend against agent spoofing.The paper highlights authentication as important for A2A deployment and suggests capability verification may perform better in client–server communication when deployed alongside authentication.
2) Defenses on Interaction Protocol Layer (L2):: Registration pollution requires strict, zero-trust registration verification, behavioral monitoring, and limits on registrations and rapid registration–deregistration activity.Servers should monitor agent- and IP-level behavior and treat abnormal registration patterns as suspicious.
2) Defenses on Interaction Protocol Layer (L2):: Capability verification combines benchmark testing with hashed capability descriptions and identifiers, while dynamic load balancing and rate limits mitigate task flooding.The hash enables other agents to check consistency when invoking an agent; queues should adapt to CPU, GPU, and memory utilization.
2) Defenses on Interaction Protocol Layer (L2):: Client–server search defenses use robust ranking algorithms, adversarial training, semantic keyword transformation, randomized selection, and historical response quality, while peer-to-peer systems monitor task lifecycles.Each peer-to-peer access point should deploy a coordinator that detects execution loops, reflecting that non-convergence is difficult to eliminate structurally.

3) Defenses on Semantic Interpretation Layer (L3): · D. Takeaways · VII. AGENT-ENVIRONMENT COMMUNICATION

The section presents semantic-layer defenses for universal, CS-based, and P2P-based communication risks, while summarizing architecture-specific protections across communication layers. It then introduces agent-environment communication and identifies MCP as its illustrated architecture.

3) Defenses on Semantic Interpretation Layer (L3):: Semantic-layer defenses are classified according to the risks arising in L3.The classification covers universal risks, CS-based communication, and P2P-based communication.
3) Defenses on Semantic Interpretation Layer (L3):: Cross-agent input detection isolates inputs and extracts task-relevant structure while filtering control-oriented, emotional, or manipulative content.This defense targets cross-agent contamination and prevents malicious content from propagating across agents.
3) Defenses on Semantic Interpretation Layer (L3):: PFI and AgentSpec defend against authority-related attacks through isolation, untrusted-data processing, privilege guards, and rule-based behavioral controls.AgentSpec lets users define trigger events, predicate checks, and execution mechanisms in a domain-specific language.
3) Defenses on Semantic Interpretation Layer (L3):: Malicious instruction filtering is proposed to defend multi-agent systems against description poisoning.The supplied passage identifies this defense but does not provide its full mechanism.
3) Defenses on Semantic Interpretation Layer (L3):: Multi-source semantic cross-validation protects centralized semantic state through layered verification and controlled updates.Agent roles, capability descriptors, and trust scores should be checked by multiple independent models or rule-based analyzers.
3) Defenses on Semantic Interpretation Layer (L3):: P2P systems can limit cognitive and ethical drift through cross-agent consistency checks and minimal shared semantic contracts.Ethically sensitive decisions should additionally undergo rule-based constraint checks.
D. Takeaways: CS-based and P2P-based agent-agent architectures both require L1 protection against data tampering and DoS through end-to-end encryption and redundant transmission.CS-based architectures additionally require protection for the centralized controller, while L2 risks and defenses vary by architecture.
VII. AGENT-ENVIRONMENT COMMUNICATION: Section VII organizes agent-environment communication and illustrates the architecture of MCP.Figure 13 presents the section organization, while Figure 14 presents MCP architecture.

A. Communication Protocols … 2) Risks from Interaction Protocol Layer (L2):

The paper frames agent-environment communication as protocol-mediated interaction involving memory, knowledge bases, and external tools. It then examines security risks across transmission and interaction layers, emphasizing tool-use vulnerabilities at L2.

A. Communication Protocols: Interaction protocols bridge natural-language reasoning and computational execution through layered resource, middleware, function-description, and metadata mechanisms.
A. Communication Protocols: MCP provides schema-agnostic, context-aware communication between language-model agents and external tools, APIs, workflows, and other resources.Its host, client, and server divide orchestration, session interaction, and tool-specification responsibilities.
A. Communication Protocols: Function-calling mechanisms standardize how agents express, trigger, and handle tool execution, ranging from lightweight JSON calls to richer chained-tool abstractions.OpenAI Function Calling emphasizes JSON-schema arguments and single-step invocation, while LangChain supports nested calls, conditionals, and fallback strategies.
B. Security Risks: Agent-environment communication uses memory, knowledge bases, and external tools as its three core operational components.
1) Risks from Data Transmission Layer (L1):: Agent-environment communication is generally more resilient to L1 risks because agents and environments commonly communicate over a LAN or on the same machine.Remote API calls and remotely downloaded tools or knowledge can still expose agents to transmission risks.
2) Risks from Interaction Protocol Layer (L2):: L2 translates high-level intentions into executable environmental actions and is a prime attack target because attackers can corrupt the interface between the LLM and environment.Its major risks concentrate in the tool-use pipeline, including tool discovery and selection.
2) Risks from Interaction Protocol Layer (L2):: Attackers can exploit malicious tools, manipulate tool selection, and abuse cross-tool chaining to influence agent behavior during multi-step execution.Threats include covert logic in externally authored tools, misleading tool descriptions, malicious content propagated between tools, and semantic misalignment.

3) Risks at the Semantic Interpretation Layer (L3): · C. Defense Countermeasure Prospect

At the semantic interpretation layer, compromised memory and external knowledge can distort reasoning, leak sensitive information, propagate malicious content, and disrupt physical systems. The paper frames these expanding attack surfaces as requiring a multi-layered, compositional defense framework.

3) Risks at the Semantic Interpretation Layer (L3):: Memory modules operate through write, retrieve, and apply stages that store information, retrieve semantically related records, and inject them into decisions.This architecture enables continuity but creates multiple points where stored information can influence later behavior.
3) Risks at the Semantic Interpretation Layer (L3):: Memory injection and poisoning manipulate persistent stores to alter reasoning or trigger unsafe behavior, without requiring model access or parameter modification.Injection uses natural interactions to create harmful memories, while poisoning implants trigger-output pairs that activate on specific inputs.
3) Risks at the Semantic Interpretation Layer (L3):: Memory extraction uses crafted queries to recover logged private file paths, authentication tokens, sensitive instructions, and other interaction data, especially in black-box settings.The attack exploits agents’ tendency to retain detailed user-agent interactions.
3) Risks at the Semantic Interpretation Layer (L3):: RAG corpora introduce adversarial surfaces where poisoned passages, metadata, or representations can bias retrieval and manipulate generation outcomes.Adversarial passage injection can optimize for high query similarity and generalize across out-of-domain corpora and tasks.
3) Risks at the Semantic Interpretation Layer (L3):: RAG retrieval from semi-private or proprietary corpora can leak sensitive content when attackers craft prompts that exploit weak permissions or similarity-based access.Large, dynamically updated corpora are harder to monitor and can be poisoned without direct interaction with the agent.
3) Risks at the Semantic Interpretation Layer (L3):: Compromised agents can propagate malware, phishing links, misinformation, tampered knowledge, and flawed reasoning through trusted publication channels and agent communication.Internal contamination can cascade across other agents’ memory modules and knowledge bases.
3) Risks at the Semantic Interpretation Layer (L3):: Polluted memory or compromised tools can produce physical disruption that appears procedurally normal, making traditional logging and anomaly detection difficult.Examples include approving defective components and creating warehouse stacking imbalances or logistics bottlenecks.
C. Defense Countermeasure Prospect: The expanding use of memory modules, retrieval augmentation, and interactive toolchains broadens attack surfaces across context propagation, planning logic, and execution flows.The paper therefore calls for a multi-layered, compositional defense framework.

1) Defenses on Data Transmission Layer (L1): … D. Takeaways

The survey organizes defenses across transmission, interaction-protocol, and semantic-interpretation layers. It emphasizes authentication for remote communication, protocol-aware and execution safeguards for tools, and layered controls against persistent-context manipulation and downstream impact.

2) Defenses on Interaction Protocol Layer (L2):: Tool defenses span protocol foundations, execution control, orchestration safety, and system enforcement because risks arise during tool requests, negotiation, and coordination.The approach applies before and during tool execution.
2) Defenses on Interaction Protocol Layer (L2):: MCP-Scan combines static tool-schema inspection with real-time proxy validation and LLM-assisted heuristics to detect protocol-enabled poisoning, cross-origin, and shadowing attacks.Its safeguards operate at registry and middleware layers.
2) Defenses on Interaction Protocol Layer (L2):: Sandboxing, permission gating, policy engines, human confirmation, schema hardening, and input/output sanitization constrain unsafe tool arguments, environments, and payloads.Minimally privileged containers restrict filesystem and network scope against threats including SSRF and data exfiltration.
2) Defenses on Interaction Protocol Layer (L2):: GuardAgent, AgentGuard, and DRIFT monitor plans, workflow constraints, and downstream executions to prevent unsafe tool chaining and adversarial propagation.DRIFT uses a Secure Planner and Dynamic Validator, while GuardAgent generates executable guards and AgentGuard models workflow conditions.
3) Defenses on Semantic Interpretation Layer (L3):: Memory and knowledge defenses combine embedding-level anomaly screening, consensus aggregation, and architectural isolation to limit poisoning across ingestion, generation, and sessions.TrustRAG screens anomalous vectors, RobustRAG aggregates overlapping source content, and DRIFT or AgentSafe constrain retained influence.
3) Defenses on Semantic Interpretation Layer (L3):: Semantic defenses also govern outbound content, preserve provenance and integrity, and gate physical execution through permissions, validation, simulation, safety envelopes, and emergency stops.High-impact external actions require review, suspicious knowledge is quarantined and re-audited, and safety-critical commands require independent confirmation.
1) Defenses on Data Transmission Layer (L1):: Remote tool invocation requires identity authentication and transmission encryption, despite comparatively low L1 risk in local communication scenarios.These measures prevent data leakage during remote tool use.
D. Takeaways: MCP-enabled agent-environment communication creates memory injection, RAG poisoning, and tool-misuse risks, making L2 protection especially important while requiring safeguards across all layers.The takeaway reiterates that remote invocation still needs authentication and encryption, even when L1 risks are relatively low locally.

VIII. EXPERIMENTAL CASE STUDY: MCP AND A2A · A. The Selection of Protocols · B. Experiments

The study selects MCP and A2A as representative, practical protocols and uses attacks to expose agent-communication vulnerabilities. Experiments demonstrate malicious code execution, retrieval-agent deception, tool poisoning, command injection, and A2A agent-selection manipulation.

A. The Selection of Protocols: The evaluation prioritizes popular and mature protocols because vulnerabilities in widely adopted, well-supported systems have greater practical value.Maturity includes complete open-source projects, test cases, and broad application or project adoption.
A. The Selection of Protocols: MCP and A2A were selected as representative protocols, with MCP showing exceptional adoption and A2A attracting rapidly increasing developer attention.MCP’s PyPI package received over 9 million downloads, its NPM download last week reached 4.2 million, and open-source MCP servers approached 2,000.
B. Experiments: MCP can enable malicious code execution by exposing an unauthenticated Bash Shell service locally on port 4444.The demonstration uses Claude Sonnet 3.7 as MCP host and the official Filesystem Server as MCP server.
B. Experiments: Retrieval-agent deception embeds malicious commands in public documents that are indexed with legitimate content and later executed by Claude after retrieval.The commands can search local environment variables and send the information to Slack; the attack was successfully achieved using Claude Opus 4.
B. Experiments: Tool poisoning hides malicious instructions in MCP tool descriptions, causing a tool call to email SSH private and public keys without alerting users.The experiment uses Claude Sonnet 4.0 with Filesystem and Gmail MCP Servers.
B. Experiments: Command injection lets a malicious MCP tool delete ./mcp file/important.md and conceal the behavior by instructing Claude not to list the remaining files.The attack was successfully conducted using Claude Sonnet 4.0 and a malicious Terminal-Controller MCP tool.
B. Experiments: A2A agent-selection manipulation makes a malicious agent consistently selected after its Agent Card emphasizes richer features and instructs the client to choose it first.Before modification, 20 queries allowed either agent to be selected; after modification, the A2A client always selected the malicious agent.

IX. FUTURE DIRECTIONS DISCUSSION … 5) Judgment and Accountability Mechanism for Agent:

Future directions emphasize defenses that remain effective under increasingly open, multimodal, and complex inputs while preserving communication speed, integrity, accountability, and cross-protocol interoperability. The paper highlights lightweight filtering, decentralized archiving, real-time supervision, universal integration, and mechanisms for tracing and quantifying agent responsibility.

1) Powerful but Lightweight Malicious Input Filter:: User inputs are the largest-scale attack carrier because they increasingly include open environmental feedback, multimodal content, and semantically complex information.These trends create substantial pressure on defenses as agent ecosystems prioritize effectiveness and LLM execution remains inherently slow.
2) Decentralized Communication Archiving:: Finance and other sensitive fields should archive communication processes and contents to audit serious crimes and mistakes after agent failures.The archive must ensure integrity and efficiency without relying on a single storage point.
2) Decentralized Communication Archiving:: Blockchain and related techniques could manage historical communication while supporting decentralized, integrity-preserving, and efficient storage.The passage identifies this approach as especially relevant because centralized-storage dependence is inadequate for security and reliability.
3) Real-time Communication Supervision:: Real-time supervision can reduce attack or mistake damage through shorter reaction times, with centralized architectures better positioned than P2P networks to monitor the entire network.P2P-based communication may require additional effort to establish collective supervision mechanisms.
4) Cross-Protocol Defense Architecture:: Different protocols still lack seamless collaboration, making universal identities across A2A and MCP difficult and potentially causing performance degradation or inconsistency errors.A universal architecture could integrate heterogeneous protocols and agents more effectively.
4) Cross-Protocol Defense Architecture:: Agent ecosystems need cross-protocol integration architectures that connect different protocols and agents, analogous to IPv4.The proposed direction addresses interoperability limitations that existing protocols solve only partially.
5) Judgment and Accountability Mechanism for Agent:: Accountability remains difficult because tiny malicious or unintentional deviations during intermediate steps can create large gaps between benign and dangerous final results.Future mechanisms must identify causative steps and quantify responsibility for each agent or action.

6) Trade-offs between Efficiency and Accuracy: … X. CONCLUSION

The paper balances communication efficiency against accuracy, anticipates self-organizing agentic networks, identifies unresolved legal and regulatory gaps, and concludes by organizing agent-communication security risks, protocols, defenses, experiments, and future directions.

6) Trade-offs between Efficiency and Accuracy:: High-token communication improves semantic richness and coordination accuracy but increases cost, latency, attack surface, information overload, and hallucination risk.Longer contexts can conceal prompt-injection and data-poisoning content more covertly.
6) Trade-offs between Efficiency and Accuracy:: Low-token communication improves efficiency through concise structured messages but may fail to express complex intentions or unforeseen scenarios.JSON-like formats reduce computational costs, increase transmission speed, simplify parsing, and minimize potential errors, while incomplete semantic coverage can cause significant information loss.
6) Trade-offs between Efficiency and Accuracy:: Future protocols should adapt redundancy and structure to task complexity, security requirements, and agent capabilities, using richer communication for exploration and concise communication for execution.
7) Towards Self-Organizing Agentic Networks:: Self-organizing agentic networks may let agents discover peers, assess capabilities, negotiate collaborations, form dynamic task groups, and disband after completion.This paradigm is presented as scalable and robust for dynamic, unpredictable environments.
B. Law and Regulation Aspect:: Existing laws and regulations have serious deficiencies that technical solutions cannot remedy, motivating accelerated legal and regulatory improvement.
1) Clarify the Responsible Subject:: Responsibility remains unclear when agents cause property damage, personal injury, or accidents during multi-agent collaboration, including uncertainty over developers, users, and enterprises.
2) Protect Intellectual Property Rights:: Legal protection for agent intellectual property is inadequate because plagiarism criteria and thresholds for its degree remain undefined.The passage gives 50% and 90% as example thresholds whose legal status is unclear.
3) Cross-border Supervision:: Cross-border agent communication complicates applicable law, international supervision, and judicial cooperation, while the survey defines and classifies the field, analyzes protocols, risks, defenses, experiments with MCP and A2A, and discusses future issues.The conclusion presents these elements as the survey’s systematic coverage of agent-communication security.