A forged or tampered message causes an agent to perform an action it would not have performed had the message been authentic. The action appears legitimate — it was issued through the right channel, in the right format, from what appeared to be the right source.

An attacker who can impersonate the orchestrator can direct any sub-agent in the pipeline to perform any action the sub-agent is capable of — including actions the real orchestrator would never authorize. The impersonator inherits the orchestrator's authority over the entire downstream fleet.

Tampered responses from one agent cause the orchestrator to make incorrect decisions for all subsequent steps. A pipeline that expects a "safe to proceed" signal and receives a forged one will proceed — potentially through a sequence of compounding errors, each step trusting the falsified output of the previous one.

Agents routinely pass sensitive information between each other: API keys, user data, access tokens, query results, and retrieved documents. An attacker with read access to an unencrypted inter-agent channel can harvest this data without ever touching either agent directly.

A previously valid message — a legitimate "approve this transaction," a "grant access," or a "deploy to production" — is re-sent at an unauthorized time. Without replay protection (message nonces, timestamps, or sequence numbers), the receiving agent cannot distinguish the replayed message from a fresh legitimate one.

By controlling the messages flowing between agents, an attacker can coordinate multiple agents simultaneously — instructing Agent A to create a resource while instructing Agent B to grant permissions on it, achieving a compound goal that neither agent would have enabled if properly overseen by the legitimate orchestrator.