Policies
OWASP ASI07 — Insecure Inter-Agent Communication
OWASP ASI07 — Insecure Inter-Agent Communication: what it does, its label on each agent, what it misses, and examples.
Catalog policy owasp-asi07-insecure-inter-agent-communication, version 0.0.2, labelled advisory on Claude Code.
What it does
Authenticate and integrity-protect the channels agents use to talk to each other, so a peer cannot be impersonated, a message tampered with, or a fake agent registered in discovery. Use when building multi-agent orchestration, agent-to-agent protocols, delegation between agents, message buses, or agent discovery services. Do NOT use for a single agent calling ordinary tools — that is owasp-asi02-tool-misuse.
On each agent
| Agent | Label | What it does there |
|---|---|---|
| Claude Code | Advisory | Advisory only. It is skill text, and nothing stops a violation |
| Cursor | Advisory | Advisory only. It is skill text, and nothing stops a violation |
| Codex | Advisory | Advisory only. It is skill text, and nothing stops a violation |
| GitHub Copilot | Advisory | Advisory only. It is skill text, and nothing stops a violation |
| Devin | Advisory | Advisory only. It is skill text, and nothing stops a violation |
| Grok | Not graded | Not graded yet for Grok |
| goose | Not graded | Not graded yet for goose |
| Antigravity | Not graded | Not graded yet for Antigravity |
| OpenHands | Not graded | Not graded yet for OpenHands |
| Kimi Code | Not graded | Not graded yet for Kimi Code |
| Factory Droid | Not graded | Not graded yet for Factory Droid |
What it misses
This policy does not state what it misses.
More
Built from engine 5a4b6287a46e and catalog 1e60d211c1bb.