# Inter-Agent Message Spoofing and Peer Impersonation

- **Severity:** High
- **Signature ID:** `83e72875-7c6f-52cc-949c-505cbbb7649f`
- **MITRE ATLAS:** AML.T0074 (Masquerading), AML.T0073 (Impersonation)
- **OWASP:** ASI03 (Identity and Impersonation), ASI05 (Cascading Failures in Multi-Agent Systems)

## Summary

A compromised or misbehaving AI agent can send messages to Slack, Teams, Discord, or email that falsely claim to come from another trusted agent or a central control system. Because agent-to-agent communication in most deployments has no cryptographic identity check, anyone who can get an agent to post can forge instructions, approvals, or handoffs that downstream systems or humans will trust.

## How the attack works

An agent (or someone controlling it) composes a message to an external messaging platform. The message body is worded to look like it originated from a different agent or from a control plane — for example a fabricated approval, a handoff notice, or an instruction attributed to a peer. Because there is no cryptographic binding between an agent's claimed identity and the actual sender, the message is accepted as authentic by anything reading that channel. The detection only sees that a message was posted to a recognised messaging endpoint; it judges impersonation by looking for these forged phrasings in the message content, not by verifying identity.

## Why it matters

If accepted at face value, a forged message can trigger unauthorized actions, false approvals, or misdirected handoffs — effectively an unauthenticated instruction channel between agents and humans.

## What you can do

- Do not treat messages in shared channels as authoritative instructions without an independent, cryptographically verifiable source for approvals and handoffs.
- Review the exact phrasing your legitimate orchestrator uses for handoffs and approvals, and separate it from other traffic so unusual claims stand out.
- Restrict which agents are allowed to post to messaging platforms that trigger real-world actions, and require a second, out-of-band confirmation for high-impact instructions like approvals.
- If your agents communicate over an internal bus not covered by common messaging platforms, add equivalent monitoring for impersonation phrasing there as well.

## Known benign look-alikes

- A genuine multi-agent orchestrator that announces handoffs in these words — allowlist its host or refine IMPERSONATION to the phrasings your own orchestrator does not use
- Status bots relaying approval outcomes from a real approval system
- Incident channels where humans quote agent messages verbatim

## References

- https://attack.mitre.org/techniques/T1656/
- https://attack.mitre.org/techniques/T1585/

---
Source: https://www.netzilo.com/threats/inter-agent-spoofing