The A2A protocol lets independent AI agents discover each other and delegate work, but it leaves security to the developer. This course teaches developers to close that gap by working through the attacks that target A2A: Agent Card poisoning and shadowing, cross-agent prompt injection, session smuggling, excessive agency, and resource exhaustion. For each attack it shows the control that stops it, at the protocol, identity, and deployment level.
Course overview covering what A2A is, why it is insecure by default, and what this course teaches. Includes learning objectives, audience, and the full syllabus.
Explains what A2A is, how it differs from MCP, and identifies the trust boundary A2A introduces between agents. Covers why that boundary needs security controls the protocol does not provide.
Covers A2A at the protocol level: how an agent is discovered, what an Agent Card contains, what crosses the wire on a call, and the states a task moves through.
Reproduces Agent Card poisoning and Agent Card shadowing attacks. Explains why each works at the protocol level and applies input-handling and discovery controls to reduce both.
Covers the two authentication questions A2A leaves to the developer: inbound authentication on the server and agent identity verification on the client. Shows how to enforce both.
Explains how prompt injection crosses an agent boundary, how a stateful session lets a malicious agent smuggle instructions across turns, and which controls reduce both.
Covers least privilege and human approval for action-taking agents in a chain, and bounding resource consumption so a single request cannot exhaust resources or run up unbounded costs.
Uses the CSA MAESTRO framework to threat model an A2A deployment. Decomposes an agentic system into layers and maps every attack in the course to where it occurs and how it is mitigated.
Provides build-side and consume-side checklists, maps each attack class to its control, and lists the insecure defaults to change before an agent goes to production.
