The AI Agent Handshake Problem

A structural problem is creeping into every enterprise: the protocols that let AI agents talk to tools, services, and each other were built for speed of adoption, not security maturity and the gap between the two is widening fast.

A paper out of the University of New Brunswick's Canadian Institute for Cybersecurity, done in collaboration with Mastercard's Vancouver Tech Hub, puts a number on that gap. "Security Threat Modeling for Emerging AI-Agent Protocols" (arXiv:2602.11327) is one of the first systematic attempts to threat-model the four protocols now competing to become the plumbing of the agentic AI era: Anthropic's Model Context Protocol (MCP), Google's Agent2Agent (A2A), the decentralized Agora protocol, and the Agent Network Protocol (ANP).

For decades, security teams have leaned on the CIA triad -confidentiality, integrity, availability -as the baseline framework for evaluating risk. The paper argues, convincingly, that this framing breaks down once you introduce autonomous agents that discover each other dynamically, negotiate their own communication protocols, and invoke tools without a human in the loop at every step. The trust boundaries aren't static anymore. An agent isn't just a passive endpoint; it's a decision-maker that can be tricked, spoofed, or quietly hijacked mid-workflow.

That's the real thesis here: agentic AI isn't just a new attack surface, it's a new category of attack surface, and most enterprise security thinking hasn't caught up.

NIST SP 800-30

Rather than treating each protocol in isolation, the authors apply a NIST SP 800-30–style lifecycle lens, mapping twelve distinct protocol-level vulnerabilities across three phases every agent or tool passes through: Creation/Configuration, Operation/Execution, and Update/Maintain.

According to the risk assessment, Creation/Configuration is the most dangerous phase. That is the point when the agent gets identity and trust and potentially has access to every inherited downstream interaction across a widely distributed system.

Comparative Analysis

Comparative architecture analysis is where the paper gets genuinely interesting for anyone architecting agentic systems today:

• MCP favors flexibility and openness as a two-way client/server connection to tools and data. The early stages integrations of this protocol may not have had robust built-in authentication.

• A2A leans on established web security standards (OAuth 2.0, JSON Web Tokens) to authenticate agents and secure task exchange via standardized "Agent Cards".

• Agora is a technology-agnostic "Layer Zero" protocol where agents negotiate their own custom communication workflows using decentralized Protocol Documents, with no central authority.

• ANP is the only one of the four to build in cryptographic, decentralized identity via W3C Decentralized Identifiers (DIDs) alongside mandatory end-to-end encryption.

Each protocol makes a different trade-off between flexibility, decentralization, and hardened trust. The paper is clear that none of them currently offers full-lifecycle protection.

Why this matters right now

The industry is moving quickly to make backend systems "agent-ready". The gaps close when the people building on top of these protocols start asking harder questions of their vendors, and start treating protocol-level trust assumptions as a first-class part of their risk assessments.

Read the full paper: Security Threat Modeling for Emerging AI-Agent Protocols (arXiv:2602.11327)