Fill ASI07: Insecure Inter-Agent Communication

[nkratk]

Filling in the ASI07 template. I work on inter-agent communication security as part of llm-trust-guard and wanted to contribute what I have learned building runtime guards for this area.

Covered:

• 6 vulnerability examples (impersonation, prompt infection, replay, unauthorized spawning, confused deputy, unscoped creds)
• 8 prevention approaches
• 3 attack scenarios grounded in documented incidents

All stats are referenced with sources in the document.

[ossumpossum]

This is a strong, well-sourced fill of ASI07, and it deserves to move rather than sit. Happy to co-author any of the below if useful. The six examples and the prevention set cover the real surface. A few additive notes, all toward verifiability and measurability, none blocking.

1. Prevention Proposal: Agentic SOC Dashboard (GSoC 2026) #1 (sign every inter-agent message) is the right first control, but HMAC and digital signatures are not interchangeable here. A shared HMAC key means any agent that can verify can also forge, so a single compromised agent still produces "valid" messages attributed to any peer. For an inter-agent-communication entry the stronger statement is per-agent asymmetric identity, which is the direction your reference Fill ASI07: Insecure Inter-Agent Communication #5 (WIMSE + SPIFFE + OAuth) points to. Recommend making Proposal: Agentic SOC Dashboard (GSoC 2026) #1 asymmetric-by-default and demoting shared-secret HMAC to a same-trust-domain fallback.

2. Each prevention control has an observable signal worth stating, so the risk reads as measurable rather than only describable. The ASI template does not carry a separate Detection section, so these fit best as observable checks alongside the controls: inter-agent messages accepted without a verified signature, messages missing a nonce or with a stale timestamp, cross-organization messages with no shared identity anchor, and delegation chains where the final action's authority is never re-validated against the original request. Each is countable. (If the project wants a Detection subsection across all ten entries, that is a template question for the leads rather than this PR.)

3. The confused-deputy example (Fill ASI07: Insecure Inter-Agent Communication #5) and Scenario Add Agent OS governance framework samples (ASI-01, ASI-02, ASI-05) #2 span more than one entry. The ASI07 part is the trust cascade, where each hop adds implicit trust to an unverified claim; the permission misuse itself is closer to ASI03 (Identity and Privilege Abuse), and the multi-hop amplification touches ASI08 (Cascading Failures). Worth scoping the example to the communication-trust cascade so ASI07 owns that and does not absorb the privilege-abuse half.

4. Source rigor: the load-bearing claims lean on single-study percentages, and each is worth tracing to the primary source before it anchors the entry. The arXiv:2507.06850 paper, for instance, headlines a broader framing (inter-agent trust exploitation compromising the tested models) rather than the specific 82% refused-from-humans figure the draft cites, so that number should be traced to where it actually appears. Same for MASLeak's 87/92 and Grantex's 93 (vendor, which you already flagged). Anchoring the opening in the mechanism, that agents apply weaker trust boundaries to peers than to humans, with the studies as supporting data, keeps the entry from aging with a single number.