OWASP Flags Insecure Agent-to-Agent Communication as Critical AI Security Risk

·1 views

OWASP's Agentic AI Top 10 list identifies insecure inter-agent communication (ASI07) as a major vulnerability in multi-agent AI systems, where messages between agents lack proper authentication, integrity checks, or semantic validation. Attackers can intercept, spoof, tamper with, or replay these messages to manipulate entire systems, exploiting the fact that agent-to-agent messages are often untyped natural language rather than structured API calls. In May 2026, Trustwave's SpiderLabs demonstrated a real-world 'Agent-in-the-Middle' attack on Google's A2A protocol, routing sensitive requests through a malicious agent by exploiting default trust in unverified agent capability cards. Palo Alto's Unit 42 separately uncovered 'agent session smuggling,' where a compromised peer agent injects covert instructions into an established cross-agent session whose identity claims are accepted without re-verification. Security experts warn that multi-agent AI systems are repeating the same internal-trust mistakes made in early microservices architecture, urging builders to apply zero-trust principles, mutual TLS, and strict schema validation to all inter-agent traffic.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How kubectl apply Works: A Step-by-Step Look Inside Kubernetes

Running kubectl apply triggers a multi-stage workflow inside a Kubernetes cluster, far beyond simply creating a container. The API Server first authenticates and validates the submitted YAML manifest, then stores the desired resource state in ETCD, the cluster's central data store. The Controller Manager continuously compares this desired state against the actual cluster state and reconciles any differences, automatically creating ReplicaSets and Pods as needed. The Scheduler then selects the most suitable worker node for each pending Pod by filtering and scoring available nodes based on resources and constraints. Finally, the Kubelet on the assigned node communicates with the container runtime to pull the image and start the container.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Secure AI Agent With Docker Sandboxing and Prompt-Injection Defenses

A developer tutorial series on building AI agents from scratch has released a new installment focused on closing security gaps in agent harnesses. The guide introduces Docker sandboxing to isolate tool execution, limiting any runaway commands to only the project directory rather than the full host machine. It also adds prompt-injection defenses to prevent the model from treating external tool output as trusted instructions, along with strict JSON-schema validation for every tool input before execution. The approach organizes each security control into its own module — covering resource limits, secret management, session control, and audit logging — to make rules easier to audit and extend. The author argues that human-only oversight is insufficient, as fatigue or inattention can cause security issues to be overlooked, making machine-level safeguards essential.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Agent-Up lets developers run multiple AI coding agent environments simultaneously

Agent-Up is a new open-source, cross-platform desktop application designed to manage multiple AI coding agent workspaces on a single machine. Each workspace receives its own isolated runtime environment, including dedicated ports, Docker services, browser sessions, grouped tabs, and separate logs. The tool addresses a common problem where parallel AI agents working on the same web app can cause port conflicts, stale processes, and mismatched browser sessions. Agents interact with their environments via an MCP server, which handles process management, port allocation, and Docker service startup automatically. Windows and macOS installers are available at agent-up.themassiveone.net, with source code hosted on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Bundler's Cooldown Feature Could Have Blocked SleeperGem Supply Chain Attack

On July 19, 2026, Aikido Security disclosed a Ruby gem supply chain attack dubbed SleeperGem, involving malicious versions of three gems — git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab. The malicious releases exploited dormant, trusted gem accounts, with two gems having been inactive since 2019 and 2020. The attack payload was designed to evade CI environments by detecting roughly 30 CI-related environment variables, instead activating on developer machines where it installed a persistent daemon and, if run as root, a setuid shell. Notably, Bundler 4.0.13 had shipped a 'cooldown' feature on June 3 — 45 days earlier — which prevents resolving gem versions newer than a specified number of days, a safeguard that would have blocked all malicious releases during their entire window of availability. Widely circulated reports about the incident contained inaccurate publication dates and inflated download figures that did not reflect the actual reach of the malicious versions.

0 comments Read more at DEV Community