If inter-agent messages travel over an unencrypted or unauthenticated network channel — even an internal network — any attacker with network-level access can observe, intercept, or inject messages. This includes attackers who have already compromised another system on the internal network (lateral movement), attackers exploiting misconfigured network boundaries, or attackers who have gained access to shared infrastructure like message brokers, load balancers, or service meshes.

The key requirement is network-level access to the channel — not application-level access to any specific agent. The vulnerability is in the channel, not the endpoint.

A compromised agent, tool, plugin, or external dependency that sits inside the multi-agent system can read and write to the communication channels it has legitimate access to. If a monitoring sidecar, logging service, or shared utility has queue access — and is compromised — it can forge, replay, or tamper with messages between agents without ever touching the agents themselves. The attack surface includes every component that touches the message transport layer, not just the agents themselves.

Anyone with access to the message broker (Kafka topic, RabbitMQ exchange, Redis queue), the shared database, or the API gateway that routes inter-agent traffic can manipulate messages without agent-level credentials. Infrastructure access is often broader than application access — a database administrator may be able to modify queued messages even without any agent-specific authorization.

A live prompt injection attack on one agent can instruct that agent to send a fabricated message to another agent in the pipeline — using its own legitimate communication channel. The injected instruction travels on an authenticated channel (because the agent is authenticated) but carries attacker-controlled content. The receiving agent has no way to distinguish between a legitimate task and an injected one sent through the same authenticated pipe.