When AI Agents Go Rogue Agent Session Smuggling Attack in A2...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/agent-session-smuggling-in-agent2agent-systems/
• Blog Title: When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems
• Suggested Section: Phishing Methodology / Ai Agent Abuse Local Ai Cli Tools And Mcp (add a sibling page: "Agent2Agent (A2A) Session Smuggling")

🎯 Content Summary

Topic
Unit 42 describes a new multi‑turn attack, “agent session smuggling,” against stateful Agent2Agent (A2A) systems. A malicious remote agent injects covert instructions mid‑session between a legitimate client request and the server’s final response, remaining invisible to end users and enabling data exfiltration and unauthorized tool use.

Context: A2A vs. MCP (why statefulness matters)
• A2A is an open standa...

🔧 Technical Details

Stateful session smuggling in agent ecosystems
Exploit any stateful, cross‑agent protocol by injecting extra turns between a client’s request and a remote agent’s final response. Maintain session continuity so the victim treats injected instructions as legitimate context. The core tactic is mid‑session, multi‑turn prompt injection that rides existing trust and is hidden from end users.

Context exfiltration via “clarification” turns
Iteratively ask benign questions to elicit system instructions, prior conversation, tool inventory and schemas. Use alternating function_call/function_response style exchanges to progressively reconstruct the victim’s capabilities and session history without ever breaking the active session.

Covert unauthorized tool execution
Smuggle directives that cause the victim to invoke sensitive tools (e.g., trading, data export) unrelated to the user’s original intent. Because UIs o...

🤖 Agent Actions

I analyzed the Unit 42 post and the existing HackTricks content and implemented the following updates:

What I added

• Created a new sibling page under Phishing Methodology focused on stateful cross-agent abuse:
  • src/generic-methodologies-and-resources/phishing-methodology/agent2agent-a2a-session-smuggling.md
  • Content covers:
    • Overview and threat model specific to stateful Agent2Agent (A2A) systems
    • Core multi‑turn “session smuggling” flow
    • Operator patterns: context exfiltration via “clarifications,” covert unauthorized tool execution, and cross‑org trust‑boundary abuse
    • Forensics/telemetry hints (ADK + A2A PoC patterns, function_call/function_response alternation)
    • Detection and hunting heuristics (smuggled‑turn density, topic drift, sensitive tool calls from delegated turns)
    • Alignment/grounding gate pseudo-logic and example rules
    • Hardening and preventive controls (out‑of‑band approvals, identity via signed AgentCards/sigstore‑a2a, provenance, time‑boxing)
    • Red‑team notes
    • References to the Unit 42 blog and relevant A2A/ADK docs

Repository changes

• New file:
  • src/generic-methodologies-and-resources/phishing-methodology/agent2agent-a2a-session-smuggling.md
• Added cross-links to related pages so the new content is discoverable:
  • Linked from AI Agent Abuse: Local AI CLI Tools & MCP
    • src/generic-methodologies-and-resources/phishing-methodology/ai-agent-abuse-local-ai-cli-tools-and-mcp.md
  • Linked from AI Agent Mode Phishing: Abusing Hosted Agent Browsers
    • src/generic-methodologies-and-resources/phishing-methodology/ai-agent-mode-phishing-abusing-hosted-agent-browsers.md
  • Added a “See also” in Phishing Methodology README alongside the other AI agent abuse pages
    • src/generic-methodologies-and-resources/phishing-methodology/README.md

Why this belongs here

• The technique is not MCP‑specific and hinges on stateful, cross‑boundary agent autonomy (A2A). It complements the existing “AI Agent Abuse” pages (local CLI/MCP abuse and hosted agent browser phishing) in Phishing Methodology by adding the stateful Agent‑to‑Agent multi‑turn attack vector (session smuggling).

Notes

• I kept the content concise, technical, and action‑oriented with short pseudo-rules and alignment-gate logic.
• Added a single new page for the technique and only minimal “See also” link insertions into related files.
• References updated at the end of the new file per guidelines.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/agent-session-smuggling-in-agent2agent-systems/

Content Categories: Based on the analysis, this content was categorized under "Phishing Methodology / Ai Agent Abuse Local Ai Cli Tools And Mcp (add a sibling page: "Agent2Agent (A2A) Session Smuggling")".

Repository Maintenance:

• MD Files Formatting: 907 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0