Why Agent-to-Agent Threats Need Their Own Taxonomy

For thirty years, cybersecurity has spoken a shared language. We classify a threat as ransomware or phishing, a zero-day or a supply-chain compromise, and everyone in the room knows roughly what is meant, what it targets, and what to do about it. That shared vocabulary is not a convenience. It is the machinery that lets defenders triage, prioritize, and respond at speed. You cannot defend what you cannot name, and for a generation we have had good names.

Autonomous AI agents broke that vocabulary, and most of the industry has been slow to notice. When an agent reads a malicious instruction hidden inside a document it was asked to summarize, and then quietly uses its email tool to exfiltrate data, which of our old categories applies? It is not malware, because no malicious code was installed. It is not phishing, because no human was deceived. It is not a conventional exploit, because no software vulnerability in the traditional sense was triggered. The agent did exactly what it was built to do. It read text and acted on it. The attack lived entirely in the meaning of the words, and our thirty-year-old taxonomy has no box for that.

This is the case for treating agent-to-agent threats as their own category, with their own names, rather than stretching the old labels to cover a fundamentally new shape of risk. The stretching is where defenders get hurt, because a mislabeled threat is a mistriaged threat.

The threat model actually changed

The reason the old categories fail is not cosmetic. The underlying threat model is different in kind. Conventional security assumes a boundary between code and data. Code is trusted and executes; data is untrusted and is merely processed. Nearly every defense we have ever built rests on that line, from input validation to sandboxing to the separation of instructions from user content. Agents erase the line. An agent's instructions arrive as natural language, and so does the data it consumes, and the model has no reliable way to tell one from the other. A sentence in a retrieved web page, an email, or a code comment can redirect the agent's behavior as effectively as anything in its system prompt. The content the agent was designed to process becomes the attack surface, and there is no malware and no stolen credential anywhere in the story.

The security community has now formalized this recognition. In December 2025, the OWASP GenAI Security Project released the Top 10 for Agentic Applications, the first peer-reviewed framework built specifically for autonomous AI, developed with input from more than a hundred security experts and endorsed by organizations including NIST, Microsoft, and NVIDIA. It defines ten risks, labeled ASI01 through ASI10, and the striking thing about the list is how few of its entries map cleanly onto anything that came before. Agent Goal Hijack, where manipulated inputs redirect an agent's objectives. Tool Misuse, where an agent is driven to abuse legitimate tools within the privileges it was properly granted. Memory and Context Poisoning, where an attacker corrupts an agent's persistent memory so that a single bad input reshapes its behavior across future sessions. Insecure Inter-Agent Communication, where spoofed messages misdirect entire clusters of agents. Cascading Failures, where one compromise propagates across a network of connected agents. These are not old wine in new bottles. They describe mechanisms that simply did not exist when our vocabulary was written.

Names that carry the right instincts

A good taxonomy does more than sort things. It tells you where to look and what to do. Consider memory poisoning, ASI06 in the OWASP list. The moment you have a name for it, you have a set of questions that name demands. Where does this agent write to long-term memory? What content is allowed to become a stored fact? Is memory partitioned between users and tenants, or can one poison another's context? None of those questions arises if you file the incident under the nearest old label, because the old labels point your attention at the wrong place. Call it data corruption and you go looking for a database integrity bug. Call it memory poisoning and you go looking at what your agent chose to remember and why. The name is the beginning of the defense.

The same holds for tool poisoning, one of the most studied agent attacks and a clean illustration of why the old words mislead. Invariant Labs disclosed the technique in April 2025. An MCP server advertises tools to an agent, and each tool carries a free-form description telling the model what it does and when to call it. The model reads that description every time it decides which tool to use, which means the description is part of the prompt. The description is attacker-controlled, and it lands inside the model's context. A malicious server can hide instructions in that text, telling the agent to read a private key and pass it as an innocuous parameter, and the human approving the tool never sees the hidden directive. Reach for an old category and you will call this an injection bug or a supply-chain issue, and you will be half right in a way that is worse than being wrong, because each label captures only part of it. It is, as one analysis put it well, a supply-chain risk wearing a prompt-injection costume. Only a purpose-built vocabulary holds both halves at once, and holding both is what tells you the two defenses you actually need, which are pinning tool descriptions so they cannot silently change and allow-listing the servers an agent may connect to.

This is not theory, and the pace is the point

It would be easier to dismiss all of this as premature if the incidents were hypothetical. They are not. The Model Context Protocol, introduced by Anthropic in late 2024 and now the connective standard for agents and tools, has accumulated a startling security record in a very short time. One analysis documented more than thirty CVEs across the MCP ecosystem in a sixty-day span, against a scan of more than two thousand implementations, of which a large majority were exposed to path-traversal issues and a striking fraction shipped without authentication at all.

The named cases sharpen the picture. CVE-2025-6514, a command-injection flaw in the widely used mcp-remote proxy, carried a CVSS score of 9.6 and could achieve full system compromise on a developer's machine when the tool merely connected to a malicious server, and it had shipped to well over four hundred thousand downloads before it was patched. CVE-2025-49596, an unauthenticated remote-code-execution flaw in Anthropic's own MCP Inspector, scored 9.6 as well and let a malicious web page reach the tool over localhost and run code on the developer's host, turning the defender's debugging tool into the attack vector. On the research side, work extending the logic of the Morris II study has shown how a self-propagating prompt can spread from one agent to the next through ordinary inter-agent messaging, replicating through the channels agents use to coordinate. Each of these is a different attack class, and that is exactly the point. A category this varied, arriving this fast, cannot be managed with a vocabulary that treats all of it as a single undifferentiated blob of AI risk.

What a taxonomy makes possible

The practical payoff of naming these threats properly is everything that names enable. Triage becomes possible, because a defender can tell a memory-poisoning incident from an inter-agent-communication incident and route each to the right response. Prioritization becomes possible, because a self-propagating agent worm and a single-hop tool misuse carry different blast radii, and a taxonomy that encodes propagation lets you sort by how far a threat can travel rather than by how loud it is. Detection becomes possible, because you can write signatures for the patterns a category predicts, such as tool descriptions that contain imperative instructions rather than plain capability text, or memory writes that arrive as commands rather than facts.

Communication becomes possible, because a report that says goal hijack via indirect injection, propagation single-hop, surface tool-layer conveys in a handful of words what a paragraph of prose would blur. And measurement becomes possible, because once the categories are fixed you can count them, watch which ones are rising, and aim defensive effort where the trend is worst. Every one of those capabilities is downstream of having agreed-upon names, which is precisely why the arrival of the OWASP framework matters more than any single vulnerability it references.

The window is now

There is a reason to care about this today rather than in a year. The security community itself has observed that agent attacks are, for the moment, mostly demonstrated rather than exploited at scale, and that this gap between proof-of-concept and mass exploitation is closing as the installed base grows and attacker tooling catches up. That window, when the attacks are understood but not yet routine, is exactly when defenders should be building the vocabulary, the detection, and the instincts, not when the incidents are already flooding in. Organizations standing up agents now are assembling the attack surface of the next several years, and the ones who name their threats clearly will triage and defend faster than the ones still trying to force agent incidents into ransomware-shaped boxes.

The old taxonomy served us well for thirty years, and it is not going away, because conventional threats are not going away. But it was built for a world where code and data sat on opposite sides of a line. Agents live on top of that line, and defending them means naming what happens there. We cannot defend what we cannot name, and it is time to name the new things.