Source-linked AI summary
A2ABreak: Systematic Security Analysis of the A2A Protocol
Alireza Lotfi, Mirza Masfiqur Rahman, Imtiaz Karim, Elisa Bertino
TL;DR
A2ABREAK addresses the lack of systematic security analysis for the A2A protocol by extracting a verified finite-state model from its natural-language specification and adversarially testing that model. It finds eleven specification-compliant vulnerabilities, with 73.3% precision and 84.6% F1 against expert review, while remaining scoped to protocol-level analysis and a full-compliance threat model.
Problem
A2A’s security has received no systematic protocol-level analysis despite enabling autonomous agents to discover, authenticate, and delegate tasks across organizational boundaries.
Method
A2ABREAK uses dual-pass specification formalization, LLM-assisted FSM construction, and adversarial verification under a full-compliance assumption.
Results
A2ABREAK uncovers eleven protocol-level vulnerabilities and achieves 73.3% precision and 84.6% F1 against expert manual review.
Takeaways & Limitations
The findings show that treating context ownership, delegation provenance, capability attestation, and credential scoping as implementation concerns leaves exploitable protocol design gaps.
Takeaways & Limitations
The analysis does not enumerate all vulnerabilities, verify specific implementations, or address transport-layer security, and assumes fully authenticated specification-compliant adversaries.
Abstract
from arXiv · showhide
The Agent2Agent (A2A) protocol, now governed by the Linux Foundation, is an open standard that enables autonomous AI agents to discover, authenticate with, and delegate tasks to one another across organizational boundaries. Designed to complement the Model Context Protocol (MCP) for tool integration, A2A is rapidly emerging as the horizontal communication layer of the multi-agent ecosystem. Yet the protocol's security has received no systematic analysis. This paper presents A2ABreak, the first rigorous systematic security analysis of the A2A protocol. We introduce a novel framework that utilizes an LLM-assisted extraction of a verified finite-state machine directly from the natural-language specification, producing a unified model of 37 states and 76 transitions from 929 formalized statements, and then systematically reasons over this model to discover protocol-level vulnerabilities through adversarial verification, under a full-compliance assumption. Our analysis uncovers 11 new vulnerabilities, each exploitable by a specification-compliant adversary without requiring any implementation flaw. Among the findings are cross-client context injection through unprotected context identifiers, credential harvesting via multi-hop identity loss in delegation chains, and data exfiltration through rogue agents advertising unattested capability claims. A2ABreak achieves 73.3% precision and 84.6% F1 against independent expert review, while a zero-shot LLM baseline operating over the same specification produces zero confirmed findings, demonstrating that explicit formal grounding is essential for sound protocol security analysis.
1. Introduction
A2A addresses the need for standardized cross-organizational agent collaboration, but its opaque execution and limited security analysis leave important protocol-level risks unresolved. A2ABREAK formalizes the specification into a verified lifecycle model and uses adversarial analysis to identify compliant attacks.
- A2A standardizes discovery, authentication, task delegation, and result exchange for autonomous agents collaborating across organizational and vendor boundaries.
- A2A complements MCP by governing horizontal agent-to-agent interactions, while MCP governs an agent’s vertical relationships with tools and data sources.
- Opaque execution broadens the attack surface because clients cannot verify a remote agent’s reasoning, tool use, intermediate state, or handling of delegated credentials.
- The protocol’s security properties had received virtually no systematic analysis beyond descriptive surveys, high-level architectures, and narrower token-lifecycle work.
- A2ABREAK formalizes natural-language specifications into 929 structured statements and a unified FSM of 37 states and 76 transitions using dual-pass extraction and verification.
- A2ABREAK identifies eleven protocol-level vulnerabilities exploitable by specification-compliant adversaries and achieves 73.3% precision and 84.6% F1 against expert review.
2. Background
A2A enables opaque communication between autonomous peer agents, whereas MCP standardizes an agent’s interaction with local tools and data. The protocols are complementary, but A2A’s peer trust model creates a broader security surface.
- 2.1. Agent2Agent Protocol (A2A): A2A is an open standard for interoperability between autonomous agents across frameworks, vendors, and organizational boundaries.
- 2.1. Agent2Agent Protocol (A2A): A2A uses a client–server model in which a client discovers, authenticates with, and delegates tasks to a remote agent over HTTPS.
- 2.1. Agent2Agent Protocol (A2A): A2A’s opaque execution hides remote agents’ internal reasoning, memory, and tool implementations from their peers.
- 2.2. Model Context Protocol (MCP): MCP standardizes the interface between an LLM application and its local tools and data sources through a client-server architecture.
- 2.2. Model Context Protocol (MCP): MCP governs vertical agent-to-tool relationships, while A2A governs horizontal relationships between autonomous peers.
- 2.2. Model Context Protocol (MCP): Unlike MCP servers under host control, A2A remote agents are opaque autonomous peers, preventing clients from verifying their handling of delegated data, credentials, or artifacts.
3. Overview
The paper analyzes whether A2A’s normative specification guarantees key security properties against fully compliant adversaries. A2ABREAK addresses this by extracting a formal FSM and adversarially testing feasible traces for missing security primitives.
- The analysis targets protocol-level vulnerabilities in A2A’s normative rules, not implementation flaws or transport-layer security concerns.
- The threat model allows a computationally bounded, fully authenticated adversary to use only protocol-conformant A2A operations as client, server, or intermediary.
- A2ABREAK parses the natural-language specification into structured statements and derives a finite-state machine with states, events, guards, and transitions.
- A protocol-level vulnerability is represented as a feasible FSM attack trace, a violated security property, and a missing primitive permitting the violation.
- 3.4. Challenges: Natural-language specifications mix preconditions, normative requirements, and data-type constraints, making faithful direct formalization infeasible.
- 3.4. Challenges: A2ABREAK separates structural and behavioral extraction, constrains model outputs, and verifies candidate traces for FSM grounding, full compliance, normative consistency, and genuine primitive absence.
4. Design of A2ABREAK
A2ABreak formalizes the A2A specification into a verified corpus and unified FSM, then analyzes that model for protocol-level vulnerabilities under full compliance.
- Design overview: A2ABreak uses three stages: specification formalization, unified FSM construction, and security analysis with vulnerability discovery and validation.Human checkpoints at stage boundaries are intended to prevent errors from propagating silently.
- 4.1. Stage A: Specification Formalization: Stage A separates structural and behavioral extraction, reconciles duplicate statements, and independently verifies the resulting corpus against the specification.The structural pass captures states, constraints, and implicit transitions, while the behavioral pass preserves normative obligation strength.
- 4.2. Stage B: FSM Construction: Stage B builds six per-stage FSMs, assigns actor metadata to states, resolves cross-stage handoffs, and deterministically merges them into one model.Shared-actor states mark trust boundaries and are primary targets for Stage C security analysis.
- 4.3. Stage C: Security Analysis: Stage C searches the unified FSM for missing guards, boundary checks, unreachable predecessors, and event-alphabet gaps using protocol-executable attack traces.Discovery is separated from adversarial falsification, and candidates are filtered through specification checks and independent manual review.
- 4.3. Stage C: Security Analysis: The security analysis assumes compliant parties, correct implementations, and established transport security, so surviving findings indicate protocol-design flaws under that scope.The assumption requires every MUST, SHOULD, and MAY to be satisfied by all parties.
5. Evaluation
The evaluation tests A2ABREAK against zero-shot analysis, validates its FSM and vulnerability pipeline, and examines refinement, complexity concentration, and execution cost. Explicit FSM grounding produced confirmed vulnerabilities where zero-shot analysis produced none, while the pipeline reduced the extracted model substantially.
- RQ1: Zero-Shot Comparison: All nine zero-shot attack candidates were rejected, whereas A2ABREAK’s explicitly grounded analysis produced confirmed vulnerability findings.The zero-shot candidates failed adversarial verification because their traces violated normative requirements.
- RQ3: FSM Refinement: The final FSM contains 37 states and 76 transitions, a 69% reduction from the raw graph and a 92% reduction from 929 extracted statements.Deduplication removes intra-stage duplicates, mechanically duplicate states, and naming-level equivalences while recovering obscured transitions.
- RQ4: Specification Complexity Concentration: Authentication contains 21 statements but 16 transitions, yielding 0.76 transitions per statement versus Discovery’s 0.24 ratio.The comparison shows that textual volume does not directly measure behavioral complexity across protocol stages.
- RQ5: Execution Cost: A single end-to-end A2ABREAK run costs $40.97, with $34.67 consumed by Stages A and B and Stage B2 costing $11.64.Mechanical stages B1, B4, and D1 incur zero API cost.
6. Security Analysis
A2ABREAK validates eleven specification-compliant vulnerabilities across the A2A lifecycle, including context injection, delegation identity loss, and unattested skill claims.
- Eleven validated vulnerabilities span discovery, initiation, task execution, and interruption, each exploitable without implementation flaws or misconfiguration.
- Cross-Client Context Injection: Any authenticated client knowing a valid contextId can inject tasks into another client’s conversation and receive responses informed by its accumulated state.The specification provides no context ownership, access token, or authorization requirement comparable to task operations.
- Identity Loss in Multi-Hop Delegation Chains: Multi-hop delegation loses the originating user identity, leaving downstream authorization requests without delegation context or a verifiable requester.The resulting request can appear to originate from an intermediate agent even when credentials are required by a downstream agent.
- Unattested Skill Claims: Signed Agent Cards authenticate publishers but do not attest that advertised skills are genuine, enabling malicious agents to receive sensitive tasks and exfiltrate data.Fabricated artifacts can propagate downstream because the protocol lacks a mechanism to distinguish genuine skill execution from fabrication.
7. Related Work
Prior work covers agentic-security threats, MCP vulnerabilities, and protocol state analysis, but does not provide a specification-level security analysis of A2A.
- Existing agent-communication research identifies broad threat landscapes, but neither performs specification-level analysis of an individual protocol.
- Finite-state-machine methods have uncovered flaws in TLS and DTLS and extracted protocol specifications, establishing precedent for model-based protocol security analysis.
- No prior work had constructed a formal A2A state machine or performed specification-driven vulnerability analysis using one, which this paper addresses.
8. Conclusion and Future Work
A2ABREAK presents a systematic A2A security analysis that finds eleven specification-compliant vulnerabilities and identifies open directions for simulation, cross-protocol analysis, and mitigation.
- A2ABREAK uncovers eleven protocol-level vulnerabilities across the A2A lifecycle under a full-compliance assumption, without requiring implementation flaws.
- The findings show that treating context ownership, delegation provenance, capability attestation, and credential scoping as implementation concerns creates exploitable design gaps.
- Future Work: Future work includes scalable A2A simulation, analysis of A2A–MCP integration security, and protocol-level mitigations.The proposed integration analysis concerns trust propagation, prompt injection effects, and authorization invariants across the protocol boundary.
Appendix A. A2A FSM
The extracted A2A FSM models protocol states, guards, transitions, authentication, task lifecycle, messaging, agent-card retrieval, and push-notification delivery.
- The FSM spans task creation and messaging, authentication, agent-card retrieval, push notifications, and terminal or interrupted task states.
- Task lifecycle guards prevent selected operations after terminal states while permitting transitions conditioned on nonterminal tasks.
- Messaging transitions include receipt and authorization of initial messages, clarification messages, version checks, and extended agent-card requests.
- Figure 9 distinguishes initial, terminal, error, interrupted, active, and inferred states, while edge styles and colors encode inference and normative strength.
- Push-notification behavior includes configuration, delivery, failure, retrying, threshold-based failure handling, and deletion of configurations.
- Authentication-related transitions cover transport security, TLS validation, discovered requirements, delegated authorization, credentialed webhook requests, and authentication challenges or rejection.