Research · A2A · protocol-level analysis

Delegated, Not Attributed.

A2A establishes identity at the transport layer and carries no delegation token. Three hops in, a task has no verifiable lineage — and that is one of eleven findings in the first systematic analysis of the protocol. Eight of them you can detect without changing a line of the spec. Three you cannot, and that distinction is the useful part.

Published 30.09.2026 · ~11 min · protocol: A2A

TL;DR

A2ABreak (arXiv:2609.10871v1, 9 September 2026, Purdue and UT Dallas) reports eleven protocol-level vulnerabilities in Agent2Agent, distributed across discovery, initiation, task execution and interruption.
Reported precision is 73.3% — eleven confirmed from fifteen candidates, F1 84.6%. A zero-shot model pass over the same specification produced nine candidates and all nine were rejected on verification.
The paper stops at disclosure. Mitigations are explicitly left to future work, and the findings sit with the A2A maintainers under the Linux Foundation awaiting a response.
We classify all eleven by one operational question: is this reachable by watching conforming traffic? Eight are. Three are not, because the information was never on the wire.
The mapping ships as SARIF 2.1.0 — eleven rules, two taxonomies, the three gaps present as notApplicable with a stated reason rather than omitted.

01 · The result

Eleven findings, and a method that matters more than the count.

Agent2Agent is the horizontal layer of the 2026 agent stack: MCP governs how an agent reaches tools, A2A governs how an agent reaches a peer. By April 2026 the project under the Linux Foundation had passed 150 supporting organisations and production deployments across several industries. Until this month it had received no systematic security analysis.

A2ABreak supplies one. The threat model is a computationally bounded adversary who cannot break cryptographic primitives and does not need to: every finding is reached by sending protocol-conformant messages, as a client, as a server, or as an intermediary holding both roles inside a delegation chain. Nothing here is an implementation bug in somebody's SDK. The specification permits all of it.

The precision figure is worth dwelling on. Fifteen candidates, eleven confirmed — and a zero-shot language-model pass over the same document produced nine candidates of which none survived verification. Reading a protocol specification adversarially is not summarisation. It is the difference between a plausible list and a list somebody checked.

02 · Distribution

Where in the lifecycle the flaws live.

01Discovery. Two findings. An agent advertises what it can do and proves none of it. Signing the card authenticates the issuer and attests nothing about the claims the card carries.

02Initiation. One finding, and the sharpest of the four stages: context identifiers carry no ownership binding, so an authenticated client can read and poison a context belonging to someone else.

03Task execution. Four findings, all classical: a stream that outlives its credential, chunks assembled without integrity checks, a check-to-use window, and a webhook target nobody validates.

04Interruption. Four findings, and the stage the specification thought about least. Scope widens, identity does not travel, cycles are not prevented, parked tasks are never reclaimed.

The shape is informative. Discovery and initiation are the stages a reviewer thinks about, and they carry three findings between them. Execution and interruption carry eight — the stages that only exist once the system is running, under load, with tasks in states nobody drew on the whiteboard.

03 · The mapping

Eleven findings against the agentic taxonomy.

Seven of the ten OWASP Agentic categories are touched. Cells carrying a marker are bindings the reference SARIF declares in relationships[]; a build gate compares this table against that file on every build, so a cell here cannot claim a binding the artifact does not assert.

Finding ASI02ASI03ASI04ASI06ASI07ASI08ASI10

A2B01 Unattested Skill Claims ————capability asserted, never proven—task delegated to a false peer

A2B02 JWS Key Trust Model Gap ——signature inherited as capability trust—issuer attested, claims are not——

A2B03 Cross-Client Context Injection ———foreign task enters a contextcontext id carries no owner——

A2B04 SSE Post-Revocation Leakage —revoked credential still delivers——stream outlives its authorisation——

A2B05 Artifact Chunk Integrity Gap ——assembled output trusted wholesalemodified chunk enters downstream context———

A2B06 Concurrent Access TOCTOU resource used past its checkdecision premise changed under it—————

A2B07 Unverified Webhook URL agent calls an operator-chosen target————outbound amplification, no ceiling—

A2B08 Auth Scope Amplification —exercised scope exceeds granted——no ceiling travels with the task——

A2B09 Multi-Hop Identity Loss —principal unknown downstream——no chain of custody on the wire——

A2B10 Circular Delegation Deadlock ————cycle forms across peersparticipants stall together—

A2B11 No Timeout from Interrupted States —parked task holds its grant———unreclaimed state accumulates—

declared in the reference SARIF · — no meaningful binding

ASI07 carries seven of the eleven, which is the expected answer and the least interesting one — A2A is the inter-agent layer, so of course its flaws are inter-agent communication flaws. The load-bearing observation is the second column. Five findings land in ASI03: scope that widens, identity that does not travel, credentials that outlive revocation, grants that parked tasks never release. In a protocol with no delegation primitive, a privilege problem is what an identity problem turns into.

04 · The operational cut

What an observer can reach, and what it cannot.

A2ABreak reports the flaws and leaves mitigation to future work: protocol extensions, formally evaluated, backward compatible. That is the right scope for the paper. It is also a 2027 answer to a question people have this quarter, because nobody is shipping a protocol extension before their next delegation chain runs.

So we ask a narrower one. Which of these eleven can you detect by watching traffic you are already entitled to watch, without modifying the protocol, the agents or the specification?

A2B01 Capability challenge plus behavioural baseline. A clone reproduces the card, not the timing profile behind it. observable

A2B02 Requires a capability attestation primitive. A valid signature over unattested claims is indistinguishable from a valid signature over true ones. gap

A2B03 Ownership violation in the topic graph: a context identifier appears under a client that did not create it. observable

A2B04 Revoke out of band, time the interval until delivery stops. The interval is the finding. observable

A2B05 Requires a per-chunk digest. Without one, a modified stream is a well-formed stream. gap

A2B06 Concurrent submission against a shared resource with the authorising state mutated between check and use. observable

A2B07 Register targets across a ladder — loopback, link-local metadata, internal, external — and record which the agent will call. observable

A2B08 Diff granted scope against exercised scope per delegation edge. Any positive delta is the finding. observable

A2B09 Requires a delegation context token. Provenance is absent from the wire, not merely unverified. gap

A2B10 Build the delegation graph from observed traffic and run cycle detection. A cycle is visible before it deadlocks. observable

A2B11 Drive a task into each interruptible state, withhold the resuming input, measure time to reclamation. observable

Eight observable, three not. The three are not harder problems — they are a different kind of problem. A delegation token, a capability attestation, a per-chunk digest: each is information the protocol never puts on the wire. No observer recovers what was never transmitted, and any tool claiming to detect multi-hop identity loss from traffic alone is describing something else.

05 · Continuity

The same seam, from the other side.

In July we wrote about A2A v1.0 signed Agent Cards. Signing closed card spoofing and in-transit tampering, and closed nothing about what the card asserts: a correctly signed card carrying adversarial description fields is a working injection vector at the agent-selection layer. Signature verification and content trust are separate gates.

A2ABreak's first two findings are that observation arrived at from the specification rather than from a deployment. Unattested skill claims and the JWS capability gap say the same thing in protocol language: identity is attested, capability is not. Two independent routes to one seam is the strongest evidence available that the seam is real and structural rather than a implementation habit.

The connection to Checked, Then Changed is equally direct. A2B06 is a TOCTOU window inside a single protocol, and A2B09 is what makes every such window unattributable after the fact — you can see that something was used past its check, and you cannot say on whose authority. Verification decoupled from use is one half. Identity decoupled from delegation is the other, and together they describe a system that can neither prevent an action nor explain it afterwards.

Behavioural baselining is where the observable eight become tractable rather than merely theoretical. ABFP profiles an agent by the shape of what it does — call sequences, timing, graph position — so an impersonating peer fails on the profile it cannot clone rather than on the card it can. Cycle detection over the delegation graph is the same machinery applied to structure instead of timing.

06 · The artifact

Reference SARIF.

Eleven rules, two taxonomies. A2ABreak identifiers bind as subset — each rule is one probe against a finding and does not establish its absence. ASI categories bind as relevant, which is a placement, not a coverage claim. Every rule carries an observability property, and the build gate fails if that property disagrees with the result kind the rule produced.

Vulnerability identifiers and descriptions follow the paper. The probe definitions, the observability classification and the ASI bindings are ours, and the file says so in properties.source rather than leaving a reader to guess which half they are reading.

↓ mst-a2a-reference.sarif.json

Source: Lotfi, Rahman, Karim, Bertino — A2ABreak: Systematic Security Analysis of the A2A Protocol, arXiv:2609.10871v1, 9 September 2026. Findings are attributed to that work; the detection classification and tooling bindings on this page are not claimed by it.