From A2A Attacks to Envelope-Layer Defense: Red-Teaming Evaluation of LLM Agents and a Three-Layer Isomorphic Attack-Defense Model

What it is

A2A-TIBA (A2A Tri-surface Implant-Bypass Attack), a concrete attack skill targeting agents communicating over the A2A protocol, plus a threat model that specifies exactly what permission level makes the attack work.

How it works

Three steps: (1) Implant — attacker holds an A2A inbound credential (any authenticated client that can deliver a Task/Message) and uses indirect prompt injection to get the target agent to deploy and run a resident callback interaction program on its own host; (2) Command — once that program is running, the attacker talks to it directly, no longer through the agent or the LLM; (3) Exfiltration (cut off in the fetched text, but named as the third stage) — attacker issues commands to attack the host and extract data via the callback channel. The core mechanism the paper emphasizes: an A2A inbound credential only grants "write content into the target's context," not tool invocation or host execution — but once malicious content is in context, the agent itself becomes the actor, and the agent's own permission set (tools, shell exec, file I/O) minus its policy gates (write-safe root, command allowlist, sensitive-file list, provenance labels) determines the actual blast radius.

Preconditions / Affected

• Attacker needs only a credential that authenticates to the target's A2A endpoint and can deliver tasks — a gray-box actor with the Agent Card and endpoint info, no system prompt or host access required.
• The target's deployment must not enforce per-skill authorization tiering (A2A's spec only gives a SHOULD-level recommendation for this, with no protocol-level binding between Task and Skill). The paper states this untiered case is "more common in practice" since public A2A services tend to issue broad-scope credentials.
• The target's security policy must permit deploying/running arbitrary programs on its own host — if it doesn't, the implant step fails regardless of credential scope.
• In deployments that do enforce skill-level authorization, the attacker additionally needs a credential tier that can trigger execution-type skills, which the paper notes lowers real-world risk.

flowchart TD
    A[Attacker holds A2A credential] --> B{Target enforces skill tiering?}
    B -->|No - broad-scope cred| C[Implant: inject prompt to deploy callback program]
    B -->|Yes| D[Need execution-tier credential or privilege escalation]
    D --> C
    C --> E{Target policy allows host program execution?}
    E -->|No| F[Attack blocked - policy gate holds]
    E -->|Yes| G[Command: attacker talks directly to callback, bypassing agent]
    G --> H[Exfiltration: steal host data]

Caveats

The fetched text cuts off mid-description of the exfiltration step and before any results/metrics (attack success rates, the 1,000-case dataset breakdown, or the envelope-layer defense findings) are presented — those numbers aren't available in this excerpt. The threat model explicitly scopes the paper's claims to the "authenticated but untiered" case as an upper bound on risk, and states it does not study how an attacker obtains initial delivery capability, relying on a cited prior work (A2ABreak) for the premise that contextual privilege escalation in A2A is achievable through legitimate means.