If an attacker sends a malicious prompt directly to an agent — through a chat interface, an API, or any channel the agent exposes to the outside world — that is direct input manipulation. AG07 is about the messages agents send to each other inside the pipeline. The attack surface is the channel between agents, not the channel between a user and an agent.
If an agent exceeds its intended scope because of how it was configured — because it was given write access to production when it should only have staging access, for example — that is an authorization or permission scoping issue. AG07 is about the communication that coordinates agents, not about what individual agents are permitted to do when they operate correctly.
If an agent misinterprets a legitimate message because of a logic error or software bug, that is a reliability or quality issue. AG07 requires that the communication channel itself was exploited — that a message was forged, tampered with, intercepted, or replayed by an attacker or compromised component.
An attacker (or compromised component) exploited a weakness in the channel, protocol, or message format that agents use to communicate with each other — forging agent identity, tampering with message content, intercepting sensitive data in transit, or replaying previously valid messages — causing one or more agents to perform actions that the legitimate orchestrator never authorized.