When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems

This report introduces “agent session smuggling,” a technique that exploits stateful, multi-turn A2A agent communications to inject hidden instructions, enabling context poisoning, data exfiltration, and unauthorized tool execution. Through two proof-of-concept scenarios involving a financial assistant and a malicious research agent, it shows how sensitive data can be leaked and unauthorized trades executed without user visibility, contrasts A2A with MCP’s generally stateless model, and recommends layered mitigations including human-in-the-loop approvals, context grounding, cryptographic agent identity verification, and exposing agent activity to users, alongside relevant Palo Alto Networks protections.