Insecure Inter-Agent Communication — Agents trust each other's output because it arrived from inside the system.
One of the ten risks in the OWASP Top 10 for Agentic Applications 2026. Below: how it actually shows up in production, the controls that address it, the evidence object that proves each control fired, and what these controls genuinely cannot do.
Get an Agent Trust Gap BriefHow it shows up
One agent's unvalidated output becomes another's authoritative input. There is often no authentication between agents at all — internal traffic is treated as trusted by default, which is the same assumption flat networks made twenty years ago.
Controls that address it
- Authenticate agent-to-agent calls; identity does not stop at the perimeter.
- Scope what one agent may ask another to do — delegation must narrow authority, never widen it.
- Validate inter-agent messages as untrusted input.
- Cap delegation depth so authority cannot be laundered through a chain.
- Record the full delegation chain on the receipt.
The evidence that proves the control fired
actor_identity and mission_identity on every hop, so the chain from originating human to final effect is reconstructable.
Schema: ApexClaw Receipts v1 — the receipt format used inside our governance audit, not a standalone protocol or ratified standard (CC-BY, DRAFT).
Honest limitation
Multi-agent orchestration frameworks vary enormously in what they expose. Some cannot represent a delegation chain at all — in that case the honest verdict is UNTESTABLE, not PASS.
Interpretation Control mappings are ApexClaw's reading of the published OWASP text, last verified 2026-08-06. Source: OWASP Top 10 for Agentic Applications 2026. Not legal advice, not a compliance determination. Full crosswalk →
← ASI06 Memory and Context Poisoning ASI08 Cascading Failures →
Common questions
What is ASI07 insecure inter-agent communication?
ASI07 insecure inter-agent communication — One agent accepts instruction from another without verifying identity or authority.
How do you defend against it?
Authenticate agent-to-agent messages, carry authority explicitly rather than implying it by trust, and never let a delegated request exceed the delegator's own scope.
Is the OWASP Agentic Top 10 a certification?
No. It is a risk taxonomy, not a certifiable standard. There is no OWASP certification for it. Its value is as shared vocabulary — see the assurance frameworks comparison.
What evidence shows this control is working?
Refusal receipts. A control that has never blocked anything is either untested or not enforced. Countable refusals with reasons are what turn a claimed control into a demonstrated one.