title: Malicious Agent-to-Agent Message Injection
id: ATR-2026-00116
rule_version: 1
status: experimental
description: |
  Detects malformed or malicious messages in agent-to-agent (A2A) communication
  channels. Attackers can embed prompt injection payloads, hidden tool calls, or
  credential forwarding requests inside inter-agent messages. When a receiving agent
  processes these messages without validation, the embedded instructions execute in
  the receiver's security context, potentially escalating privileges across the
  multi-agent system.
author: ATR Community
date: 2026/03/26
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_agentic:
    - ASI07:2026
  mitre_attack:
    - T1557 - Adversary-in-the-Middle
  owasp_llm:
    - LLM01:2025
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
compliance:
  eu_ai_act:
    - article: '15'
      context: Malicious agent-to-agent message injection exploits unvalidated inter-agent channels to execute unauthorized actions; Article 15 cybersecurity requirements mandate detection and resistance against such adversarial input manipulation.
      strength: primary
    - article: '14'
      context: A2A message injection can cause agents to take actions outside their authorized scope without human awareness, eroding the effective oversight capability Article 14 requires for high-risk AI systems.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the agent-manipulation technique (Malicious Agent-to-Agent Message Injection).
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Malicious A2A message injection is a documented adversarial input risk targeting inter-agent communication channels; MP.5.1 requires that adversarial input risks to AI systems are identified and tracked to enable detection of embedded payload attacks.
      strength: primary
    - subcategory: MG.2.3
      context: A2A message validation failures represent a risk requiring active treatment; MG.2.3 requires that risk treatment plans are implemented for identified AI risks, including validation controls on all inter-agent message channels.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the agent-manipulation technique (Malicious Agent-to-Agent Message Injection).
      strength: primary
  iso_42001:
    - clause: '6.2'
      context: AI system plans under clause 6.2 must include risk treatment activities for inter-agent message injection, ensuring that A2A communication validation is a planned control rather than an afterthought.
      strength: primary
    - clause: '8.1'
      context: Clause 8.1 operational controls require that inter-agent messages are validated before execution, preventing injected instructions from executing in the receiving agent's security context.
      strength: secondary
tags:
  category: agent-manipulation
  subcategory: a2a-message-validation
  scan_target: mcp
  confidence: medium
agent_source:
  type: multi_agent_comm
  framework:
    - autogen
    - crewai
    - langchain
    - langgraph
    - swarm
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:ignore|disregard|forget)\s+(?:all\s+)?(?:previous|prior|above|earlier)\s+(?:instructions|context|rules|guidelines)
      description: Prompt injection attempting to override receiving agent's instructions
    - field: content
      operator: regex
      value: '(?i)(?:new|updated|revised)\s+(?:system\s+)?instructions?\s*:'
      description: Injected instructions disguised as system updates
    - field: content
      operator: regex
      value: (?i)(?:forward|send|pass|share)\s+(?:your\s+)?(?:credentials?|tokens?|api[_\s]?keys?|secrets?)\s+(?:to|back)
      description: Requesting the receiving agent to forward its credentials
    - field: content
      operator: regex
      value: (?i)(?:execute|run|call|invoke)\s+(?:this\s+)?(?:tool|function|command)\s*:.*(?:exec|eval|system|spawn)
      description: Embedded tool call instructions in agent message
    - field: content
      operator: regex
      value: (?i)(?:you\s+(?:are|must)|from\s+now\s+on)\s+(?:now\s+)?(?:act\s+as|serve\s+as|become|operate\s+as)
      description: Role reassignment injection attempting to change agent behavior
  condition: any
  false_positives:
    - Agent orchestration systems legitimately updating agent roles
    - Security testing frameworks simulating injection attacks
    - A DevOps orchestration agent legitimately issuing 'updated system instructions:' as part of a configuration management workflow where role changes are authorized
response:
  actions:
    - alert
    - snapshot
confidence: 65
wild_validated: 2026/04/08
wild_samples: 53577