Vulnerability / research
A trusted agent could raise a spending limit in a delegation experiment
Reported
Published here
What happened
In a simulated reimbursement, a trusted intermediary changed the authorized maximum from €120 to €9,000. The final agent accepted the higher amount because the intermediary held the same key used to authenticate the original authorization.
Parties and reporting
AI tools and systems: Agent2Agent (A2A) research prototype, Shared authorization key, Per-hop request signatures
Outcome
The prototype rejected 14 of 15 adversarial test conditions. The remaining condition exposed a missing scope check in one verifier. In a separate test, a participant already holding the shared key could change the spending limit. No real payment or production compromise occurred.
Operating lesson
Give downstream agents a verifiable copy of the originator’s authorization. Reject any handoff that expands the amount, recipient, or actions beyond what was originally approved.
Evidence and limits
The manuscript was submitted November 4 and appeared in arXiv’s November 6 public listing. The findings apply to the authors’ fixed four-party prototype; they do not establish a defect in the A2A protocol or a way for an outsider to forge a signature.