A2ABreak exposes spec-compliant attacks in A2A

Problem

This paper analyses the security of the Agent2Agent (A2A) protocol, an emerging open standard for autonomous AI agents to discover, authenticate with, and delegate tasks across organisational boundaries. A2A is designed for opaque execution, where a client delegates work to a remote agent without visibility into the remote agent's internal reasoning or intermediate state. The specification uses non-normative guidance for many security controls and leaves key mechanisms optional, creating an attack surface that has not been systematically characterised. The authors target protocol-level flaws that remain exploitable even when all parties and implementations fully comply with the specification.

Approach

The authors present A2ABreak, a three-stage framework combining constrained LLM assistance with formal verification to derive and analyse a protocol finite-state machine from the natural-language specification. Stage A performs dual-pass extraction to produce a verified corpus of 929 structured statements by separating structural definitions from behavioural rules and applying human verification. Stage B builds six per-stage FSMs, resolves inter-stage transitions and performs deterministic and semantic deduplication to produce a unified FSM of 37 states and 76 transitions. Stage C searches the FSM for candidate attacks, then subjects each candidate to adversarial verification that grounds traces in FSM states, confirms executability under a full-compliance assumption, and verifies that the required protective primitive is genuinely absent from the specification. All LLM steps are constrained by a domain-specific language and human checkpoints to limit hallucination and ensure soundness.

Key Findings

• Eleven protocol-level vulnerabilities discovered that are exploitable by specification-compliant adversaries without requiring implementation bugs or misconfiguration.
• Cross-client context injection: conversation contexts use contextId values with no ownership binding or access control, allowing an authenticated adversary to inject tasks into another client's context, read accumulated state and poison future interactions.
• Multi-hop identity loss and credential harvesting: identity is only established at the transport layer and not propagated through delegation chains, enabling intermediaries to harvest credentials and forcing out-of-band credential acquisition that lacks delegation provenance.
• Unattested skill claims and data exfiltration: the AgentSkill model is entirely self-asserted with no attestation, permitting rogue but spec-compliant agents to advertise false capabilities, receive sensitive delegated tasks and exfiltrate or fabricate artifacts without protocol-level detection.
• Methodological results: the framework achieved 73.3 percent precision and 84.6 percent F1 against independent expert review, while a zero-shot LLM baseline produced zero confirmed findings, indicating the importance of explicit formal grounding.

Limitations

The analysis is specification-level only: it assumes correct implementations, proper transport security and fully compliant parties. It does not test specific implementations, nor does it examine transport-layer cryptographic breaks. The adversary model is constrained to behaviour permitted by the protocol. The approach depends on LLM assistance, though mitigations include a constraint language and manual verification steps.

Implications

From an offensive perspective, attackers operating within the A2A protocol can, without deviating from the spec, inject tasks into others' contexts to steal or manipulate conversation state, silently harvest and reuse credentials by exploiting delegation chain gaps, and advertise false skills to receive and exfiltrate sensitive data or inject fabricated outputs into multi-agent workflows. These vectors permit persistent poisoning and cross-organisational data exposure in enterprise settings that rely on A2A for critical workflows.