A remote peer sends a message over a real A2A communication channel but places a forged claim that its text represents a local user or preapproved instruction. The defender may trust the claimed message envelope more than the verified sender. The study describes attacks that alter envelope labels and authority claims without changing the underlying…
Inspect the ClaimsCase · DiggingBeagle record
An authenticated A2A peer message could still forge the authority of a local user
A controlled agent-to-agent communication study separates sender transport identity from the claimed instruction authority inside the message.
Scope
A fabricated peer message is not itself a valid local-user grant. These are benchmark conversations rather than confirmed customer operations.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The investigators vary the peer-envelope wording and forged authority claims in a controlled A2A testbed. The transport peer is authenticated, but the alleged user grant inside its message is not. Results do not measure customer deployments or cryptographically bound delegation. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-022-A · CLM-CP22-022-B · The Envelope Layer: An Underestimated Surface of LLM Agent Defense
At a glance
Generalization to servers that sign both sender identity and authorized human principals has not been demonstrated.
Limits and uncertaintyFull account
A remote peer sends a message over a real A2A communication channel but places a forged claim that its text represents a local user or preapproved instruction. The defender may trust the claimed message envelope more than the verified sender.
The study describes attacks that alter envelope labels and authority claims without changing the underlying authenticated peer channel. The authors separately test memory following earlier successes and failures, showing that remembered interaction outcomes can affect later susceptibility. Primary evidence.
A fabricated peer message is not itself a valid local-user grant. These are benchmark conversations rather than confirmed customer operations.
Bind peer identities and delegated-user grants cryptographically, keep remote agent claims below actual local-user instructions and re-check side-effect permissions.
Claims & evidence
CLM-CP22-022-AThe study describes attacks that alter envelope labels and authority claims without changing the underlying authenticated peer channel.supported
Basis: reported finding
- supportsThe Envelope Layer: An Underestimated Surface of LLM Agent Defenseprimary disclosure
Section III threat model; Sections IV and V A2A experiments
CLM-CP22-022-BThe authors separately test memory following earlier successes and failures, showing that remembered interaction outcomes can affect later susceptibility.supported
Basis: reported finding
- supportsThe Envelope Layer: An Underestimated Surface of LLM Agent Defenseprimary disclosure
Section III-D and V-B memory experiments
Controls and mitigations
- Bind peer identities and delegated-user grants cryptographically, keep remote agent claims below actual local-user instructions and re-check side-effect permissions.
Unknowns and contradictions
- Generalization to servers that sign both sender identity and authorized human principals has not been demonstrated.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199