Agents routinely pass sensitive information between each other as part of normal operation. An orchestrator delegates a task that includes user PII. A data agent returns query results containing account information. A security agent passes retrieved credentials to a deployment agent. All of this data is in transit between agents.

What's at risk on an unencrypted channel: API keys and service credentials passed as task parameters. User personal data included in retrieved context. Internal system topology exposed in routing messages. Security scan results that reveal vulnerability details. Authentication tokens included in tool call parameters.

The "internal network" false comfort: Many organizations treat internal network traffic as implicitly confidential. In cloud and containerized environments, "internal" often spans multiple availability zones, shared VPCs, and multi-tenant infrastructure. Traffic that seems internal may traverse segments accessible to other tenants or to compromised internal services. Encryption in transit should not be treated as optional just because traffic stays inside a VPC.

Passive vs. active eavesdropping: Type 5 alone is passive — the attacker reads without interfering. But eavesdropped messages enable Types 1, 2, and 4: by learning the message format and content, the attacker can then forge, tamper with, or replay messages they've observed.

Many agent architectures use a shared task queue: the orchestrator publishes tasks, and specialized agents consume them. If an attacker gains write access to the queue — through compromised infrastructure credentials, a misconfigured IAM policy, or a supply-chain attack on a component with queue access — they can inject arbitrary tasks.

The consuming agent has no way to distinguish a legitimately queued task from an injected one. The task arrived on the correct queue; that's the only verification the agent performs. Injected tasks execute with the full authority of the consuming agent, subject only to that agent's own scope limitations.