Before Your Agent Trusts a Stranger: How A2A v1.0 Signs Agent Cards

2026-07-18 · Source: Towards AI - Medium · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Intermediate, quick

Summary

The Agent2Agent (A2A) protocol, designed for agent discovery, previously faced a critical security flaw where public Agent Cards – JSON documents detailing an agent's name, version, skills, and listening URL – could be tampered with. Specifically, an attacker could alter the "url" field, redirecting an unsuspecting agent's tasks and data to a malicious host. A2A version 1.0, which became stable in April 2026, resolves this vulnerability by implementing **signed Agent Cards**. This article examines the precise nature of this signature, validates its structure against the installed SDK rather than marketing claims, and provides a comprehensive, end-to-end demonstration of the signing and tampering process with real output. This enhancement prevents redirection attacks by ensuring the authenticity of the agent's advertised endpoint.

Key takeaway

For AI Architects designing secure multi-agent systems, A2A v1.0's signed Agent Cards are crucial. If you are deploying agents that discover each other via public endpoints, you must upgrade to A2A v1.0 by April 2026 to prevent redirection attacks. This ensures your agents only send tasks and data to verified, legitimate service URLs, safeguarding against malicious tampering of discovery information. Prioritize validating Agent Card signatures in your agent's trust framework.

Key insights

A2A v1.0 secures agent discovery by signing public Agent Cards, preventing redirection attacks via URL tampering.

Principles

• Public discovery mechanisms require robust authenticity checks.
• Unsigned configuration data is vulnerable to redirection.
• Trust in agent communication starts with verified identity.

Method

A2A v1.0's method involves cryptographically signing Agent Cards to verify the integrity of critical fields like the interface "url" and provider identity.

In practice

• Implement A2A v1.0 for secure agent discovery.
• Validate Agent Card signatures before routing traffic.
• Protect "/.well-known/agent-card.json" integrity.

Topics

• Agent2Agent Protocol
• Agent Discovery
• Digital Signatures
• JSON Security
• Redirection Attacks
• Protocol Security

Best for: AI Engineer, AI Architect, AI Security Engineer

Related on AIssential

• Zero trust must now move at agent speed — Agentic AI's speed demands immediate, granular zero trust implementation with unique agent identities and continuous, real-time access verification.
• The Red Agent POV: The One Boolean That Broke a B2B Platform’s Credit System — A single client-controlled boolean flag bypassed a B2B platform's entire paywall, exposing 600M+ contact profiles.
• TrustedARI: Towards Trust-Native Agentic Routing Infrastructure for Agentic AI — TrustedARI secures AI agent interactions with external services via novel cryptographic protocols, ensuring privacy and verifiable transactions.
• Agent Registration Is the Next Domain Name System — Agent registration and identity are foundational for the agentic web's security and trust.
• Introducing the Red Agent POV Series — AI-powered offensive security agents can autonomously discover complex, logic-driven vulnerabilities at scale, surpassing traditional methods.
• Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP — Emerging AI agent protocols face significant, understudied security risks across their lifecycle due to design choices.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Towards AI - Medium.