TriOngle

AG6Architect AI agent scope

A2A and multi-agent trust review

When agents talk to agents, each one is an input to the next. AG6 reviews how they authenticate each other, what they accept, and how a failure is contained.

Price on requestAsk about AG6How pricing works

What it is for

The Agent2Agent protocol lets agents built on different frameworks work together without exposing their internals; it is open source under Apache 2.0 and governed by the Linux Foundation.⁠[1] Its current release is v1.0.1, published in May 2026.⁠[2] As soon as agents delegate to agents, each one is an input to the next, and trust has to be designed.

What we look at

  • How agents authenticate peers and verify what a remote agent claims it can do.
  • Session smuggling: a malicious remote agent using an open session to slip covert instructions to a client agent among normal requests. The research that described it recommends out-of-band human approval for sensitive actions, context grounding, verified agent identities such as signed agent cards, and visible agent activity.⁠[3]
  • Cascades: how one failed or compromised agent spreads errors through the others.
  • Kill switches: who can stop an agent or the whole system, and whether it actually stops.

OWASP lists the risks as ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures and ASI10 Rogue Agents.⁠[4]

What you receive

A peer authentication review, session-smuggling test results, a cascade analysis and tested kill switches.

Framework mapping

The frameworks this scope is aligned with, the version we map to, and what we map. Aligned with means we use the framework; it does not mean any body has certified TriOngle.

FrameworkVersionWhat we map
OWASP Top 10 for Agentic Applications2026 edition, 9 Dec 2025⁠[5]ASI07 Insecure Inter-Agent Communication; ASI08 Cascading Failures; ASI10 Rogue Agents
Agent2Agent (A2A) protocolv1.0.1, May 2026⁠[2]Agent cards, authentication, sessions
Agent session smuggling in A2A systems31 Oct 2025⁠[3]Session smuggling and its mitigations

Related scopes

References

Numbered in the order they are first cited on this page; each entry links back to the places that cite it. Every source was opened on 4 November 2026.

  1. ↑ a2aproject/A2A. GitHub.
  2. ↑ a b A2A releases. GitHub. v1.0.1, May 2026.
  3. ↑ a b When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems. Unit 42, 31 October 2025.
  4. ↑ OWASP top 10 for agentic applications 2026: Understanding the risks of agents and tools. Giskard, 18 December 2025. Lists the ten entries ASI01 to ASI10.
  5. ↑ OWASP Top 10 for Agentic Applications for 2026. OWASP Gen AI Security Project, 9 December 2025.