# Malicious Agent-to-Agent Message Injection

- **Severity:** High
- **Signature ID:** `72642392-b6e3-4dc3-a34f-e7c5490c5422`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution), LLM01 (Prompt Injection)

## Summary

When AI agents talk to each other, one agent can send a message that looks like normal data but actually contains hidden commands. If the receiving agent doesn't check the message carefully, it will follow those hidden commands as if they were legitimate instructions.

## How the attack works

An attacker (or a compromised agent) crafts a message sent through the agent-to-agent communication channel. The message embeds a prompt injection payload, a disguised tool call, or a request to forward credentials, rather than plain conversational content. The receiving agent processes the message without validating its source or content, so the embedded instructions run with that agent's own permissions. This lets the injected content escalate privileges or trigger actions across the wider multi-agent system.

## Why it matters

An attacker can get a receiving agent to execute unauthorized actions, leak credentials, or spread control across multiple agents in the system, using the trust between agents rather than needing separate access to each one.

## What you can do

- Treat inter-agent messages as untrusted input and validate their structure and content before acting on them.
- Require explicit authentication and authorization checks before an agent accepts role changes or system instruction updates from another agent.
- Log and review agent-to-agent messages that contain phrases like 'updated system instructions' or embedded tool-call syntax.
- Restrict what actions a receiving agent can take based solely on another agent's message, especially privilege changes or credential handling.

## Known benign look-alikes

- Agent orchestration systems legitimately updating agent roles
- Security testing frameworks simulating injection attacks
- A DevOps orchestration agent legitimately issuing 'updated system instructions:' as part of a configuration management workflow where role changes are authorized

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00116

---
Source: https://www.netzilo.com/threats/atr-malicious-agent-to-agent-message-injection