A2A agents accepted peer claims while aggregate task results hid principal failures

A2A communication makes it easy to pass an instruction or result between agents. It does not make the sender's claimed facts authoritative for the receiver's principal. In the Salesforce-led study, collaborating agents represented different parties with separate records, credentials and obligations. A lead agent could deliver an apparently acceptable aggregate result while failing to verify an assertion from another party or overlooking whether each participant honored its own scope.

The researchers separated environmental side effects, result correctness and behavior toward the respective principals. Their more than 2,500 controlled runs across 488 scenarios exposed failure modes that a simple pass/fail metric for the lead answer could hide. The scenarios are simulations, so they establish possible coordination and verification defects, not a known mass compromise of deployed A2A services.

The useful security question is which party is authorized to attest each fact, not whether the message arrived over a compatible protocol. A receiver needs an independent verification path when a counterparty's claim can authorize payment, data access or irreversible work. Transport identity and principal authority are related but distinct checks, especially when agents delegate actions across organizational boundaries.