Insecure Inter-Agent Communication is item 7 of the OWASP Top 10 for Agentic Applications 2026 (ASI07): messages passed between agents that are spoofed, replayed, or simply unauthenticated, because nothing in the channel verifies who actually sent them.

The room before this one, ASI06: Memory & Context Poisoning, was about a single agent trusting its own unverified past; it closed on this: once an agentic system involves more than one agent passing messages to each other, a poisoned memory sitting inside a single agent is only the opening move. This room picks that up directly: one agent trusting another agent's unverified word, the same lack of verification aimed at a different channel. What you are chasing here is not a memory that lied about its own past. It is a message that arrived with no sender, and a second agent that never thought to ask.

The Scenario

Same TryTrainMe estate as the rest of this module: the same eight agents, the same security engineer's seat. You still talk only to the orchestrator, which delegates to seven sub-agents over a shared message queue. This room turns on a weakness that has been sitting in that queue the whole time: any agent can post to it claiming to be any sender, and nothing checks.

Learning Objectives

• Explain what ASI07 covers and how it differs from ASI01's immediate goal hijack and from ASI03's credential-focused identity abuse.
• Name the three failure modes of an unauthenticated inter-agent channel: spoofing, replay, and protocol downgrade.
• Trace a real, published inter-agent-communication attack from its trust assumption to its exploited consequence.
• Explain how compromising one agent enables one hop of lateral movement to a second agent that trusts it, without touching the second agent's own credentials.
• Match a given ASI07 scenario to the mitigation(s) that would have closed it.

Prerequisites

• Agentic Fundamentals: Orchestrators, sub-agents, and A2A protocols at a definitional level, assumed baseline.
• ASI01: Agent Goal Hijack: The immediate-hijack framing for a forged message, assumed and not re-taught here.
• ASI03: Agent Identity & Privilege Abuse: Non-human identity and agent-to-agent trust vocabulary, assumed baseline.
• ASI06: Memory & Context Poisoning: Direct predecessor; the unverified-trust pattern this room reuses for a different channel.