Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP
2026/02/11 by Zeynab Anbiaee, Mahdi Rabbani, Mansur Mirani +4 · 1 voice · 1 citation
Computer Science · #cs.AI #cs.CR
paper · pdf · doi:10.48550/arxiv.2602.11327
arxiv published 2026/02/11 · arxiv updated 2026/04/17
Abstract
The rapid development of the AI agent communication protocols, including the Model Context Protocol (MCP), Agent2Agent (A2A), Agora, and Agent Network Protocol (ANP), is reshaping how AI agents communicate with tools, services, and each other. While these protocols support scalable multi-agent interaction and cross-organizational interoperability, their security principles remain understudied, and standardized threat modeling is limited; no protocol-centric risk assessment framework has been established yet. This paper presents a systematic security analysis of four emerging AI agent communication protocols. First, we develop a structured threat modeling analysis that examines protocol architectures, trust assumptions, interaction patterns, and lifecycle behaviors to identify protocol-specific and cross-protocol risk surfaces. Second, we introduce a qualitative risk assessment framework that identifies twelve protocol-level risks and evaluates security posture across the creation, operation, and update phases through systematic assessment of likelihood, impact, and overall protocol risk, with implications for secure deployment and future standardization. Third, we provide a measurement-driven case study on MCP that formalizes the risk of missing mandatory validation/attestation for executable components as a falsifiable security claim by quantifying wrong-provider tool execution under multi-server composition across representative resolver policies. Collectively, our results highlight key design-induced risk surfaces and provide actionable guidance for secure deployment and future standardization of agent communication ecosystems.
Citations
- MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Servers
- Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystem
- Semantic Attacks on Tool-Augmented LLMs: Securing the Model Context Protocol Against Descriptor-Level Manipulation
- Toward a Safe Internet of Agents
- Securing the Model Context Protocol (MCP): Risks, Controls, and Governance
- Agent Discovery in Internet of Agents: Challenges and Solutions
- Security Analysis of Agentic AI Communication Protocols: A Comparative Evaluation
- MCPGuard : Automatically Detecting Vulnerabilities in MCP Servers
- Toward Understanding Security Issues in the Model Context Protocol Ecosystem
- MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
- Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools
- IoT-MCP: Bridging LLMs and IoT Systems Through Model Context Protocol
- A Comparative Study of Rule-Based and Data-Driven Approaches in Industrial Monitoring
- Mind Your Server: A Systematic Study of Parasitic Toolchain Attacks on the MCP Ecosystem
- Agent Communications toward Agentic AI at Edge -- A Case Study of the Agent2Agent Protocol
- Agent Network Protocol Technical White Paper
- A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures
- Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers
- Small Language Models are the Future of Agentic AI
- Comprehensive Vulnerability Analysis is Necessary for Trustworthy LLM-MAS
- ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control
- Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem
- Position: Collaborative Agentic AI Needs Interoperability Across Ecosystems
- Security Concerns for Large Language Models: A Survey
- Internet of Agents: Fundamentals, Applications, and Challenges
- Security of Internet of Agents: Attacks and Countermeasures
- Unveiling the Landscape of LLM Deployment in the Wild: An Empirical Study
- A survey of agent interoperability protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP)
- A Survey of AI Agent Protocols
- Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies
- MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits
- Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
- Large Language Model Agent: A Survey on Methodology, Applications and Challenges
- Beyond Self-Talk: A Communication-Centric Survey of LLM-Based Multi-Agent Systems
- Multi-Agent Collaboration Mechanisms: A Survey of LLMs
- The Road to Artificial SuperIntelligence: A Comprehensive Survey of Superalignment
- Imprompter: Tricking LLM Agents into Improper Tool Use
- A Scalable Communication Protocol for Networks of Large Language Models
- Converging Paradigms: The Synergy of Symbolic and Connectionist AI in LLM-Empowered Autonomous Agents
- The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)
- Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning
- PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models
- StruQ: Defending Against Prompt Injection with Structured Queries
- Security and Privacy Challenges of Large Language Models: A Survey
- Security and Privacy Challenges of Large Language Models: A Survey
- A Comprehensive Overview of Large Language Models
- Generative Agents: Interactive Simulacra of Human Behavior
- A Brief History of Artificial Intelligence: On the Past, Present, and Future of Artificial Intelligence
Cited by
Discussions
Related