feat: AVE-2026-00065 -- A2A agent card poisoning via embedded adversarial instructions - #96
Merged
Conversation
…rial instructions Sixth and final record of the config/protocol-surface audit (AVE-2026-00060 through 00064, #93), the only one involving a genuinely multi-agent mechanism. Includes positive/negative conformance fixtures, regenerated dist/ave-records-latest.json, and README updates (badge, stats table, record index -- now covers all six of this audit's records including the five from #93, which didn't touch README per its own narrower skill-step scope at the time). Confirmed distinct from AVE-2026-00041 (MCP server-card injection) by direct comparison before drafting: different protocol (A2A, not MCP), no .well-known path or tool.description field, payload surface is the agent's own self-declared identity/capabilities in a peer discovery exchange, not a file fetched before a tool call. Two corrections applied to the draft: - component_type was "mcp_server", inherited from the previous MCP-focused batch; this record is explicitly about the A2A protocol and affects the receiving agent, not an MCP server component. Corrected to "agent". - owasp_mcp was missing entirely (required once status is active). Added ["MCP10", "MCP06"], matching AVE-2026-00020's mapping (Cross-Agent A2A, the closer behavioral analog) over AVE-2026-00041's MCP-tool-specific codes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AVE-2026-00065: A2A agent card poisoning via embedded adversarial instructions (HIGH, AIVSS 7.1).
Sixth and final record of the config/protocol-surface audit that produced AVE-2026-00060 through 00064 (#93, merged), the only one involving a genuinely multi-agent mechanism.
Distinct from AVE-2026-00041 (MCP server-card injection), confirmed by direct comparison before drafting: different protocol (A2A, not MCP), no
.well-knownpath convention, notool.descriptionfield. The payload surface is the agent's own self-declared identity/capabilities within a peer discovery and delegation exchange, not a file a client fetches before a tool call.entry_class: server_card_documentis reused rather than forked for A2A -- both protocols' capability-declaration documents serve the same structural role in the taxonomy; the protocol-specific detail lives inpayload_surfaceand the record's ownaivss.notes, which also flags this as a judgment call worth revisiting against the record-abstraction policy once it's finalized.Two corrections applied to the draft
component_typewas"mcp_server", inherited from the previous MCP-focused batch. This record is explicitly about the A2A protocol and affects the receiving agent, not an MCP server component. Corrected to"agent".owasp_mcpwas missing entirely -- required oncestatusisactive, regardless of the record being about a non-MCP protocol. Added["MCP10", "MCP06"], matching AVE-2026-00020's mapping (Cross-Agent A2A, the closer behavioral analog) over AVE-2026-00041's MCP-tool-specific codes (MCP03/MCP09).README updates
Badge, stats table, and record index now cover all six records from this audit (00060-00065) -- #93 didn't touch README per its own skill-step scope at the time; this PR catches both batches up in one pass: 65 total records, 1 CRITICAL / 14 HIGH / 48 MEDIUM / 2 LOW.
Validation
python3 scripts/validate_records.py: all 65 records valid.python3 scripts/check_fixtures.py: all 65 records have positive + negative fixtures.pytest tests/ -x -q: 260 passed.node scripts/build-records.js: dist/ave-records-latest.json + manifest regenerated (65 records); frozen v1.1.0 snapshot correctly untouched.Scope notes
No detection-rule PR opened in bawbel/scanner -- separate, coordinated PR in that repo's own tracker per CONTRIBUTING.md Step 4, not requested here.
🤖 Generated with Claude Code
Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com