The orchestrator trusts whatever it believes is one of its agents. This post attacks that belief two ways: registering a rogue agent into the system, and hijacking a legitimate agent's identity through DNS and hosts-file manipulation.
Once your text rides an internal agent's output, the workflow itself does the damage: laundering malicious links into a rendered answer, and steering an LLM-mediated SQL agent toward operating-system command execution.
Talking A2A yourself: bypassing the orchestrator to call workers directly, injecting through data and file parts, impersonating the orchestrator, hijacking other users' tasks, and turning push notifications into SSRF.
Find every agent before you attack any of them: sweeping the network for A2A services, pulling and reading Agent Cards, building the attack-surface map, and mining OpenAPI schemas for the endpoints the cards don't mention.
Real deployments split work across many agents that talk to each other. This post maps the coordination patterns, the frameworks that build them, and the Agent-to-Agent (A2A) protocol that wires them together over the network.