MCP and A2A solve interoperability. They let agents find tools, discover
each other, and delegate tasks. Neither was built to hide who's talking
to whom.
The actual vulnerability record
In April 2026, OX Security disclosed a systemic flaw in Anthropic's
Model Context Protocol — unsanitized commands executing through MCP's
transport layer. Estimated exposure: 200,000 instances across more than
7,000 public servers.
That's a code-execution problem, not a metadata problem. Worth being
precise about the distinction — no messaging layer fixes an RCE bug.
The metadata problem is separate, and it's structural, not a single CVE:
- A2A agents publish Agent Cards — JSON files listing capabilities and endpoints, specifically so other agents can find them. Useful for interoperability. The opposite of unlinkability.
- Researchers demonstrated a compromised WhatsApp MCP server, manipulated through poisoned tool descriptions, could exfiltrate entire message histories with no auth bypass required.
- Gartner projects 40% of enterprise applications will integrate AI agents by 2026. Every integration is a new metadata surface, forming at machine speed.
What we built to close that gap
Z-TEXT is a messenger on the BitcoinZ blockchain (BTCZ, Sapling-shielded
since 2017). The relevant part for agent use:
- Identity is a keypair — a 24-word seed generates a shielded z-address. No phone number, no email, no account server.
- Every message is encrypted locally (AES-256-GCM), then broadcast as a shielded BTCZ transaction. zk-SNARKs hide sender, recipient, and amount on-chain.
- Nothing in that flow requires a human. Key generation, encryption, and broadcasting are function calls — an agent process can hold its own seed and run the loop autonomously.
Z-TEXT doesn't replace MCP or A2A. It's a private transport that can sit
underneath them — agents keep using MCP/A2A for discovery and delegation,
and route the actual payload through Z-TEXT when the content of the
exchange needs to stay private, not just its existence.
One honest limitation, stated plainly: block timestamps are public on
any blockchain — that's not something zk-SNARKs hide or claim to. What's
shielded is which transaction belongs to which conversation.
Full technical breakdown, threat model comparison, and FAQ:
https://z-text.org/ai-agents-metadata-problem-z-text-fixes-it/
Security architecture and what it deliberately doesn't protect against:
https://z-text.com/docs/security
Curious what this community thinks — is metadata-layer privacy something
agent protocol designers should be building in natively, or is it
correctly left to a transport layer underneath?
Top comments (0)