Anthropic's Model Context Protocol (MCP) specifies a standard for LLM-to-tool communication. Google's Agent-to-Agent (A2A) protocol addresses agent-to-agent task delegation. Both include identity and capability concepts — but neither mandates cryptographic message signing in their baseline specifications as of early 2025. Security researchers demonstrated in 2024 that MCP tool responses could be tampered with when the underlying transport lacked integrity protection.

The emerging consensus in the agent security community is that the security properties of these protocols depend entirely on how they are deployed: TLS, mTLS, and message signing are implementation choices that protocol specifications leave to deployers. This creates a standards gap — the protocol exists but the security guarantees don't automatically follow from using it.

The pattern in Scenario 1 (compromised monitoring tool with queue access) reflects a real and growing attack surface. As agent pipelines incorporate more third-party tools — monitoring, observability, logging, testing — each tool that is granted write access to a shared message bus or queue becomes a potential attack vector. Research on software supply-chain security (including the SolarWinds incident pattern) applies directly to agentic pipelines: a trusted component with infrastructure access that gets compromised grants the attacker that component's access.

The mitigation is not just to vet third-party tools, but to enforce least-privilege access — logging tools should have read-only access to message buses, not write access — and to verify message integrity so that even a compromised component with write access cannot inject undetected modifications.

Replay attacks are a well-understood class of vulnerability in distributed systems security, documented extensively in authentication protocol literature going back to the Needham-Schroeder protocol and Kerberos design papers. The application to agent pipelines is new in framing but not in mechanism: the solutions (nonces, short-validity timestamps, sequence numbers) are the same ones used in financial transaction protocols, OAuth, and API authentication standards (e.g., the nonce claim in JWTs, the jti — JWT ID — for replay prevention).