Agents extend trust to the channel, not the sender. Without cryptographic authentication, any party that can write to the channel can impersonate any agent on it.

Authentication and integrity are separate requirements. mTLS proves who sent a message at connection time; message signing proves the content wasn't changed between sender and receiver.

Orchestrator impersonation is the highest-impact attack type. The orchestrator has authority over the entire downstream pipeline — impersonating it gives the attacker control of all sub-agents simultaneously.

Internal traffic is not inherently trusted. In cloud and containerized environments, "internal" traffic may be readable by compromised services, overpermissioned tools, or shared VPC segments. TLS everywhere.

Replay attacks exploit message validity without tampering. A captured genuine message is a reusable attack token unless nonces and timestamps enforce freshness on every received message.

MCP and A2A protocols are emerging standards for inter-agent communication. Their security depends entirely on implementation: protocols that don't enforce mutual authentication and signed messages remain vulnerable regardless of the protocol name.