Your orchestrator receives a message from ResearchAgent: task complete, proceed to next step. The format is correct. The API key is valid. But that message could have come from anything sharing the same key, including an attacker who compromised a worker three hops away.
Multi-agent pipelines that authenticate agents by API key or message content alone are structurally equivalent to an unauthenticated service mesh. Any agent holding the shared credential can impersonate any other agent in the system. The orchestrator has no mechanism to detect it.
The Orchestrator Validates the API Key, Not the Agent
In every major multi-agent framework, LangGraph, CrewAI, AutoGen, and the Anthropic SDK, agent messages carry no cryptographic provenance. The orchestrator authenticates the session, not the specific agent within it.
OWASP ASI07 documents the direct consequence: unauthenticated inter-agent messages allow any compromised agent to inject malicious instructions into all downstream agents. ArXiv:2603.09002 taxonomizes this into two patterns. RIP_4 describes compromised intermediate agents that relay falsified messages while appearing as legitimate senders. RIDC_2 describes receiving agents that process injected directives as trusted peer communications.
3 attack paths emerge from this absence of identity. A compromised worker sends falsified results to the orchestrator. An attacker intercepts the message bus and injects fabricated responses. A malicious agent forges a tool response with content the orchestrator treats as coming from an authorized agent. In all 3 cases, the API key is valid, the session is authenticated, and the attack succeeds without leaving any identity trace.
This Is Not a Prompt Injection Problem
Most practitioners conflate agent identity spoofing with prompt injection. ArXiv:2605.05440 demonstrates they are independent problems: even with perfect injection defenses, authorization propagation across delegation chains remains broken by design.
The paper formalizes 3 distinct sub-problems. Transitive delegation: authority bounds become undefined in agent chains, where each step inherits authority without verifying how far that authority should extend. Aggregation inference: individually authorized accesses synthesize information no single access should reveal. Temporal validity: authorization state changes mid-workflow while agents operate with already-expired short-lived tokens.
Semantic Intent Fragmentation proves the point empirically: 71% success rate with no prompt injection. The attack decomposes requests into individually benign subtasks that jointly violate policy. Injection attacks manipulate an agent's context; identity spoofing presents false provenance about who sent a message. They are orthogonal failure modes. Fixing one does not fix the other.
API Keys Are Shared Credentials
Session-level authentication answers whether this client is allowed to use the system. It does not answer whether this specific message came from ResearchAgent or an attacker impersonating it. Shared credentials collapse the distinction between principals.
OWASP ASI03 documents the production pattern: agents operate with shared API keys and borrowed user sessions. A shared key means any holder speaks for all agents in the system. The Cline incident of February 2026 shows the result at scale. A malicious instruction embedded in a GitHub issue title triggered an authenticated Claude session to install an attacker-controlled package on approximately 4,000 developer machines. The session was valid. The agent identity was spoofed.
ArXiv:2606.28679 tested LangChain, LangGraph, LlamaIndex, and Stripe Agent Toolkit and found the same pattern across all frameworks. Shared credentials are the norm; per-agent identity is not. Session-scoped tokens do not prevent one agent from impersonating another within the same authorized session, because the token proves session membership, not individual agent identity.
Production Frameworks Ship the Vulnerable Channel
The agent state and checkpoint layer, the mechanism frameworks use to pass context between agents, has produced exploitable CVEs. LangGraph produced 3 in consecutive months, all reachable through the inter-agent context channel.
CVE-2025-67644 (CVSS 7.3): SQL injection in langgraph-checkpoint-sqlite before 3.0.1, via metadata filter keys. CVE-2026-28277 (CVSS 6.8): unsafe msgpack deserialization in LangGraph before 1.0.10, enabling arbitrary object reconstruction from checkpoint data. CVE-2026-27022 (CVSS 6.5): RediSearch query injection in @langchain/langgraph-checkpoint-redis before 1.0.1. Chaining CVE-2025-67644 with CVE-2026-28277 achieves RCE on self-hosted deployments via get_state_history() with user-controlled filter input.
CSA's MCP security research reveals another dimension: 1,862 publicly accessible MCP servers responded to unauthenticated requests in a July 2025 internet scan. The MCP authorization specification explicitly marks authorization as optional. Any process with a valid connection can claim any identity within the protocol.
Per-Agent Cryptographic Identity Exists at Three Tiers; Two Work
3 solution tiers exist. Session-level authentication is the structural failure described throughout this post. The other 2 work, but in different contexts.
SPIFFE/SPIRE operates at the infrastructure layer: per-agent mTLS certificates (X.509 SVIDs), short-lived, auto-rotated. Identity binds to the workload, not the shared secret. For agents running in containers within a controlled cluster, SPIFFE works well. The limitation is infrastructure control dependency. For pipelines crossing heterogeneous trust boundaries, it is not portable.
AgentDID (arXiv:2604.25189) operates at the protocol layer: per-agent W3C DID-based keypairs, trustless verification without centralized authority, blockchain-anchored credentials. The result is portability across heterogeneous infrastructure without requiring a shared secret between orchestrator and worker.
AIP (arXiv:2603.24775) is the most production-ready option for pipelines using MCP or Google's A2A protocol. It uses RFC 8785 JSON canonicalization with digital signatures, built on UCAN and Biscuit tokens for cross-protocol delegation. Invocation-Bound Capability Tokens from arXiv:2605.05440 complement this with 0.049ms verification latency, viable for high-frequency production pipelines. The MAGO Intel tool (intel.mago.team) audits multi-agent pipeline configurations for shared credential usage and unsigned message passing. It flags orchestrators that route based on message content rather than verified sender identity.
Four Checks to Run on Your Pipeline Before Anything Else
Before investing in AgentDID or SPIFFE, 4 auditable conditions separate pipelines with structural identity problems from those that have closed the most exploitable variants.
Check 1: do any two agents use the same API key or credential? If yes, they are indistinguishable to the orchestrator and a single compromise speaks for all.
Check 2: are inter-agent messages signed? If no, any party with message bus access can inject or replay messages arbitrarily.
Check 3: does your state store accept user-controlled filter inputs without sanitization? This is the CVE-2025-67644 pattern, exploitable without any identity spoofing.
Check 4: can a worker return any content that the orchestrator acts on without checking its origin? If yes, the confused deputy condition exists by construction, regardless of outer-edge authentication.
The confused deputy problem was formally described in 1988. Multi-agent AI systems rediscovered it in 2025, at scale, in production, with real CVEs. The attack surface is not the model. It is the unsigned, unauthenticated channel between agents that every major framework ships by default.
Top comments (0)