Agent Communication Graphs Leak Workflows, Enable Preemptive Attacks

A new paper from computer scientist Bijaya Dangol (arXiv:2606.07150) exposes a critical security risk in AI agent interoperability protocols like Google's A2A and Anthropic's MCP. While these protocols encrypt message content (often end-to-end), they leave the communication graph in the clear: which agent contacts which, at what time, and how often. In agent systems, endpoints carry capability labels, workflows are structured and chained, and interactions couple to real actions. This means an observer can infer not just past relationships but the pending workflow—the task being assembled and the action likely to follow. At machine speed, an adversary can act on that inference before the workflow completes. The threat is therefore workflow integrity, not just privacy.

Dangol provides a formal threat model, identifies what makes agent metadata uniquely revealing (semanticity, prospectivity, actuation), and defines transport- and bootstrap-layer privacy properties. In a case study using real A2A protocol traffic, a classifier trained on passive metadata alone (no payloads) recovers a task's class well above chance from only the workflow's opening. Applying the proposed privacy properties drives recovery sharply back toward chance. The adversary's leverage is also quantified: from a workflow's opening and under a fixed budget, an attacker choosing which workflows to act on realizes most of a clairvoyant attacker's advantage over a metadata-blind one. The paper evaluates candidate transports—SimpleX/SMP, Tor, mixnets—against these properties and shows an A2A binding that respects metadata privacy is expressible, though it surfaces the protocol's identity assumptions.