When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems

Unit 42’s threat analysis introduces a new attack vector dubbed agent session smuggling, targeting stateful cross‑agent communication in Agent2Agent systems. The technique exploits ongoing sessions to inject hidden instructions between a client request and the server’s reply, enabling context poisoning, data exfiltration or unauthorized tool execution without end‑user awareness.

The researchers describe a framework where a malicious remote agent can persist across multiple turns, adapt its strategy and exploit built‑in trust between collaborating agents, making it harder to defend against than traditional MCP‑style threats. Two proof‑of‑concept scenarios demonstrate how a rogue agent could leak internal state such as chat history and tool schemas, or trigger unauthorized trades by abusing delegated capabilities.

Mitigations include enforcing HitL confirmations for sensitive actions, grounding context to maintain conversation anchors, cryptographic validation of remote agents through AgentCards, and exposing real‑time agent activity to users to improve detection. Published: 31 October 2025.