title: Insecure Inter-Agent Communication Detection
id: ATR-2026-00076
rule_version: 1
status: experimental
description: |
  Detects insecure communication patterns between agents in multi-agent
  systems. Covers message authentication bypass, unverified delegation
  chains, message replay indicators, channel confusion attacks, and
  unsigned command injection. Unlike ATR-2026-030 (cross-agent attack)
  which focuses on impersonation and prompt injection content, this rule
  targets structural communication integrity failures: missing
  authentication tokens, tampered routing headers, replay timestamps,
  and unauthenticated command channels.
  Note: Pattern-based detection of communication security failures. Protocol-level inspection planned for v0.2.
author: ATR Community
date: 2026/03/09
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM06:2025
    - LLM05:2025
  owasp_agentic:
    - ASI07:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0043 - Craft Adversarial Data
compliance:
  eu_ai_act:
    - article: '15'
      context: Article 15 cybersecurity requirements for high-risk AI include protecting agent communication channels against spoofing, replay, and message integrity attacks; this rule detects structural communication failures between agents.
      strength: primary
    - article: '14'
      context: Spoofed inter-agent messages can trigger unauthorized agent actions without any human-visible audit trail, undermining the traceability required by Article 14 human oversight provisions.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the agent-manipulation technique (Insecure Inter-Agent Communication Detection).
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Spoofed, replayed, and unauthenticated inter-agent messages are adversarial inputs that exploit trust assumptions in multi-agent communication channels; MP.5.1 requires that these structural communication integrity attacks are identified and tracked.
      strength: primary
    - subcategory: MG.2.3
      context: Detection of message spoofing, replay attacks, and null authentication in agent channels triggers risk treatment plans to quarantine compromised messages before they cause unauthorized actions downstream; MG.2.3 requires these treatment processes are defined.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the agent-manipulation technique (Insecure Inter-Agent Communication Detection).
      strength: primary
  iso_42001:
    - clause: '6.2'
      context: ISO 42001 clause 6.2 risk treatment plans must address inter-agent communication integrity failures including message spoofing and replay; this rule implements the detection control for structural authentication weaknesses in agent-to-agent channels.
      strength: primary
    - clause: '8.1'
      context: Clause 8.1 operational controls require that inter-agent communication operates with verified message authentication; detection of null tokens, forged IDs, and unauthenticated commands enforces the integrity requirements for correct agent pipeline execution.
      strength: secondary
tags:
  category: agent-manipulation
  subcategory: inter-agent-communication
  scan_target: mcp
  confidence: medium
agent_source:
  type: multi_agent_comm
  framework:
    - autogen
    - crewai
    - langchain
    - langgraph
    - swarm
    - a2a
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:auth(?:entication)?|signature|token|hmac|nonce)\s*[:=]\s*(?:null|none|empty|missing|undefined|false|0|"")
      description: Missing or null authentication in inter-agent message metadata
    - field: content
      operator: regex
      value: (?i)(?:forward(?:ed)?|relay(?:ed)?|proxy|pass(?:ed)?\s+through)\s+(?:from|by|via)\s+[a-zA-Z0-9_-]+\s+(?:without|no|missing)\s+(?:verification|validation|auth|signature|check)
      description: Message forwarded without verification of source agent
    - field: content
      operator: regex
      value: (?i)(?:replay(?:ed|ing)?|re-?send(?:ing)?|duplicate)\s+(?:message|request|command|instruction)\s+(?:from|with|using)\s+(?:timestamp|id|nonce)\s*[:=]?\s*["']?\d{4}[-/]\d{2}
      description: Message replay attack with stale timestamp
    - field: content
      operator: regex
      value: (?i)(?:channel|endpoint|destination|routing)\s*[:=]\s*["']?(?:debug|test|internal|admin|privileged|unmonitored|raw)["']?
      description: Message routed to debug/unmonitored channel
    - field: content
      operator: regex
      value: (?i)(?:broadcast|multicast|flood)\s+(?:to\s+)?(?:all|every|each)\s+(?:agents?|workers?|nodes?|peers?)\s*[:.]
      description: Broadcast command to all agents without scoping
    - field: content
      operator: regex
      value: (?i)(?:inject(?:ed|ing)?|insert(?:ed|ing)?|append(?:ed|ing)?)\s+(?:into|to)\s+(?:message\s+)?(?:queue|bus|stream|channel|pipeline)\s+(?:directly|without|bypassing)
      description: Direct injection into message bus bypassing validation
    - field: content
      operator: regex
      value: (?i)(?:trust(?:ed)?|verify|accept)\s+(?:all|any|every)\s+(?:incoming|inbound|received)\s+(?:messages?|commands?|requests?|instructions?)\s+(?:from|without)
      description: Agent configured to trust all incoming messages without verification
    - field: content
      operator: regex
      value: (?i)(?:message_id|msg_id|request_id)\s*[:=]\s*["']?(?:forged|spoofed|fake|crafted|manipulated)["']?
      description: Explicitly forged message identifier
    - field: content
      operator: regex
      value: (?i)(?:man[_-]?in[_-]?(?:the)?[_-]?middle|intercept(?:ed|ing)?|eavesdrop(?:ping)?|sniff(?:ing)?)\s+(?:on\s+)?(?:agent|inter-agent|a2a)\s+(?:communication|messages?|traffic)
      description: Man-in-the-middle interception of agent communication
    - field: content
      operator: regex
      value: (?i)(?:unsigned|unauthenticated|unverified)\s+(?:command|instruction|directive|action|message)\s+(?:received|accepted|processed|executed)
      description: Unsigned command accepted and processed by agent
    - field: content
      operator: regex
      value: (?i)(?:source|sender|origin|from)\s*[:=]\s*["']?(?:unknown|unverified|anonymous|spoofed|forged|untrusted)["']?
      description: Message from unknown or unverified source agent
    - field: content
      operator: regex
      value: (?i)(?:delegation|handoff|transfer)\s+(?:chain|path)\s*[:=].*(?:>|->|=>).*(?:>|->|=>).*(?:>|->|=>)
      description: Long delegation chain (3+ hops) without intermediate verification
  condition: any
  false_positives:
    - Agent frameworks logging communication debug info during development
    - Security audit tools intentionally scanning for communication weaknesses
    - Documentation or comments describing inter-agent security architecture
    - Test harness messages with intentionally missing auth for unit testing
response:
  actions:
    - block_input
    - escalate
    - alert
    - snapshot
  auto_response_threshold: high
  message_template: |
    [ATR-2026-076] HIGH: Insecure inter-agent communication detected.
    Agent {agent_id} involved in unauthenticated, spoofed, or tampered
    message exchange. Pattern: {matched_pattern}. Message quarantined.
    Session: {session_id}. Review agent communication security.
confidence: 81
wild_validated: 2026/04/08
wild_samples: 53577