Why this matters now
The official A2A protocol documentation describes an open standard for AI agents to securely communicate, collaborate and solve complex tasks together. Its specification includes operations such as sending messages, streaming messages, getting tasks, listing tasks, canceling tasks, subscribing to task updates, managing push notification configuration and retrieving extended agent cards.
That is useful infrastructure. It also means future agent systems will have more cross agent evidence. Task identifiers, context identifiers, messages, artifacts, status updates, push notifications, authentication information, security schemes, agent cards, skills, extensions and metadata. Every one of those can become a claim that influences the next agent's decision.
Nine A2A and handoff patterns ship in this release: GLS-ACE-041 (agent card skill description privilege escalation), GLS-ACMI-021 (A2A agent card security scheme description injection), delegation bridge rows GLS-V3-042, GLS-V3-062, agent protocol state rows GLS-V3-066, GLS-V3-069 and agent workflow rows GLS-V3-028, GLS-V3-041, GLS-V3-043 all searchable in the pattern database. The shared shape: A2A, handoff, planner, worker or orchestrator language combined with receipt, token or revocation language being reused as current authority.
Plain language explainer
Imagine a planner agent asks a worker agent to fetch evidence, summarize a result or prepare a change. The worker responds with a receipt: “Task accepted.” Later, a human revokes the task, narrows the scope or replaces the worker. If another component still sees the old receipt and treats it as active permission, the workflow has an integrity problem.
The problem is not that agents talked to each other. The problem is that evidence about a previous state crossed into a later state without being rechecked. A stale acknowledgement becomes a green light. A revoked token becomes proof of approval. A confirmation from one context is replayed into another. A worker's old task status is rebound to a new planner request.
That is why A2A security needs runtime trust. The workflow may have valid identities, signed messages, transport security and agent cards. But before an agent acts, it still needs to ask whether this particular receipt, nonce, revocation marker, task status or artifact belongs to this action, this context, this role, this time and this approval path.
Three concrete attack examples
A planner sends a task to a worker. The worker acknowledges it. A user then revokes the task because the scope changed. A downstream executor only sees the earlier acknowledgement and proceeds. The attack succeeds because a stale receipt outranks a newer revocation.
An attacker causes a worker to produce a confirmation token for a harmless task. Later, the same looking token is attached to a different handoff that touches data export, package publishing, a ticket transition or a deployment step. The token exists, but it does not prove this action was approved. The same borrowing documented in cross agent approval laundering.
A task status update from one conversation says a worker completed validation. In another context, an agent reuses that status as if validation still applies. The old artifact or status update becomes evidence for a new action. The safe workflow binds status, artifact, requester, worker, time and action together before trusting the result.
What normal controls solve. And what they do not
Use those controls. The point is not to replace A2A authentication or authorization. The point is to avoid letting yesterday's valid evidence become today's unsafe instruction.
How Sunglasses catches it
Sunglasses is an input filter for AI agents. For A2A integrity confusion, the useful question is not just “is this agent allowed?” It is: what evidence is the agent using to justify the next step and is that evidence still valid? The scanner looks for these signal families in handoff text:
A2A can move work between agents. Runtime trust decides whether the evidence attached to that handoff should still authorize this action now.
Security checklist for A2A handoffs
What not to overclaim
The A2A protocol itself is not insecure. This article targets a workflow integrity failure around stale evidence. The surfaces where evidence moves, not a flaw in the specification.
Sunglasses does not implement the A2A protocol and does not replace A2A authentication, authorization, transport or signature layers. It filters the agent readable text that rides those channels.
The patterns shipping here are detection coverage for the integrity confusion threat shape. Each verified against its own attack fixture and a hard clean corpus. They do not claim exploitation in the wild.