Sources & References — AG07:2026

The primary specification for this vulnerability. Defines inter-agent communication attacks, describes attack vectors (forgery, interception, replay, manipulation), and lists prevention strategies including mutual authentication, message signing, and encrypted channels. All module content is based on this specification.

Defines the standard for LLM-to-tool communication. Security properties (authentication, message integrity) depend on deployment choices not mandated by the protocol specification itself. Security researchers in 2024 demonstrated that MCP tool responses could be tampered with when transport lacked integrity protection.

Defines a protocol for agent task delegation and capability discovery. Like MCP, security guarantees depend on implementation: mutual authentication and signed messages are not baseline requirements in the protocol specification.

Foundational paper on authentication protocol design. Introduced replay attack vulnerabilities and nonce-based defenses that underpin all modern authentication protocols. The replay protection mechanisms described in MIT05 are direct applications of this work.

Defines the JWT standard including the jti (JWT ID) claim for replay prevention and exp (expiration) for freshness enforcement. The basis for agent identity tokens and signed message implementations described in MIT01 and MIT02.

Defines the JSON Web Signature standard used for message-level signing (MIT02). Specifies how messages are canonicalized and signed to allow integrity verification at the receiving agent.

Covers service-to-service authentication patterns including mTLS and JWT-based service identity, directly applicable to agent-to-agent authentication in multi-agent pipelines (MIT01, MIT03). The security principles for microservices apply directly to agent architectures.

Authentication and session management requirements. Section V6 requirements on mutual authentication and replay prevention apply directly to inter-agent communication channel security.

Documents the supply-chain attack pattern where a trusted third-party component (monitoring software) is compromised and used to access systems that trust it. The Scenario 1 pattern (compromised monitoring tool with queue write access) is a direct application of this attack class to agent pipelines.

Covers SQS resource-based access policies and IAM permission scoping for queue access — directly applicable to preventing queue injection (Type 6) and implementing MIT06 (least-privilege message routing) in AWS-based agent pipelines.

Requires covered entities to implement technical security measures to guard against unauthorized access to PHI transmitted over electronic communications networks. Applies to Scenario 5 (healthcare agent pipeline with unencrypted internal channel): unencrypted transmission of PHI is a reportable breach regardless of whether active exploitation occurred.