A2ABreak extracts a 37-state machine from the A2A spec and finds 11 protocol-level flaws that a fully compliant attacker can exploit

arXiv·high signalXBlueskyLinkedInCopy link

arXiv 2609.10871 used an LLM to turn 929 formalized statements from the Linux Foundation A2A specification into a verified model of 37 states and 76 transitions, then searched it adversarially. The 11 new vulnerabilities include cross-client context injection through unprotected context IDs, credential harvesting through identity loss in multi-hop delegation, and exfiltration by rogue agents advertising capabilities nobody attests. A zero-shot LLM reading the same spec confirmed zero findings, while the formal approach scored 84.6% F1 against expert review. Teams adopting A2A should treat context IDs and agent cards as untrusted input until the spec closes these gaps.