ASI07Insecure Inter-Agent Communication

The scenario

A payment agent and booking agent coordinate a dinner reservation. Payment fails and no valid receipt is issued, yet the handoff channel contains a PAID message claiming to come from payment-agent. If the booking agent trusts only that claimed sender, it confirms the reservation. Compare actual payment state, the handoff message, and the booking decision.

How it works

Unauthenticated Agent Message: A from: payment-agent field does not authenticate its sender. Without reliable identity and integrity checks, a forged handoff can be accepted as trusted input by the next agent.

Handoff–State Mismatch: PAID is a claim in a message, not the payment service’s actual transaction state. Even an authenticated message needs matching order, transaction state, and replay checks; agent prose alone does not complete payment.

OWASP 2026 risk reference ↗

9:41

Dinner Team

Payment and booking assistant

AI assistant ready