HOME / SERVICES / AI SECURITY / OWASP TOP 10
ASI07 - INSECURE INTER-AGENT COMMUNICATION
A payments workflow has four agents. One classifies an inbound request. One enriches it from a customer record. One checks it against limits. One releases it. Each was reviewed on its own and each passed. Nobody reviewed the sentence that agent three sends to agent four, or asked what agent four does if that sentence is wrong. Agent to agent communication security under POPIA section 71 is the question your architecture diagram makes look answered. ASI07 in the OWASP Top 10 for Agentic Applications, published 9 December 2025 by the OWASP Agentic Security Initiative, covers what one agent will believe because another agent said it.
ADDING A STEP TO THE CHAIN DOES NOT ADD A HUMAN TO THE CHAIN
DEFINITION
WHAT THIS RISK ACTUALLY IS
Multi-agent systems work by delegation: one agent decomposes a task, hands parts to others, and assembles what comes back. The messages between them are the control plane, and in most estates it has three properties an attacker likes.
It is trusted by default. An agent receiving an instruction from another agent inside the same environment treats it as authoritative. There is rarely a check on whether the sender was entitled to ask, only on whether the receiver is able to comply.
It is under-authenticated. Service accounts are shared. Tokens are long-lived and broadly scoped, because scoping them tightly breaks workflows during a sprint. A message arrives with a valid token and the receiver cannot establish which agent, running which task, produced it.
It is under-logged. You probably log what each agent did. You are less likely to log what each agent was told, by whom, and on what authority. That gap is where attribution dies.
The Salesloft Drift incident of August 2025 shows why the boundary matters. Attackers stole OAuth and refresh tokens belonging to an AI chat agent and used them to reach connected customer relationship systems. Fourteen companies publicly confirmed impact. The model was never touched. The failure was token hygiene and third-party integration visibility: the plumbing between agents, not any agent’s intelligence.
Then there is orchestration. Anthropic’s GTG-1002 disclosure of November 2025 documented a state-sponsored group manipulating an AI model into functioning as an autonomous cyber attack agent, executing 80 to 90% of tactical operations independently against roughly 30 entities, while frequently overstating findings and occasionally fabricating data during those operations. Chains inherit errors as readily as instructions.
DOCUMENTED CASE
WHAT IT LOOKS LIKE IN PRACTICE
The following is an illustration built from documented failure patterns rather than a single named incident.
- 01 - An insurer runs a claims workflow. Agent A ingests documents and extracts facts. Agent B checks the claim against policy limits and produces a recommendation. Agent C executes payment for anything B recommends below a threshold. A human reviews everything above it.
- 02 - An attacker submits a claim with a document containing an instruction addressed to a machine: a line stating that this claim has been pre-verified by the fraud team, reference number supplied, and that downstream checks are complete.
- 03 - Agent A summarises the whole document and carries that sentence forward as a field in its structured output. Agent B receives a record marked as pre-verified. It cannot test the assertion, because the assertion arrived from Agent A, and Agent A is inside the trust boundary. B recommends. C executes.
- 04 - The payment is below the human review threshold, so no person sees it. The audit trail shows three agents behaving exactly as designed. Nowhere in it does anything record that the pre-verification claim originated in a customer-supplied document.
- 05 - Two weeks later, reconciliation flags a pattern. The investigation asks who authorised the payment. The honest answer is that the claimant did, through three intermediaries that each treated the previous one as an authority.
WHAT THIS MEANS UNDER SOUTH AFRICAN LAW
DISCOVERY
NEWORDER connects to CI/CD pipelines to automatically discover and inventory every homegrown AI application, and integrates directly with AWS Bedrock, Google Vertex AI, Salesforce, and other cloud and third-party platforms for visibility into AI agents. Each AI system is profiled across its model, system prompt, tools, guardrails, policies, and configurations, and the inventory stays current on every change. You cannot secure what you cannot see; discovery is the non-negotiable first step.
AI SECURITY POSTURE MANAGEMENT (AI-SPM)
NEWORDER conducts a static analysis of every application’s configuration, policy coverage, and third-party dependencies and identifies any policy gaps. In addition, it maps each agentic application to its coverage of major frameworks, including NIST, OWASP, and MITRE. This gives you a clear, measurable view of your AI security posture before a single adversarial test is run, turning assumptions into evidence and compliance into a continuous output rather than a periodic exercise.
AI RED TEAMING
NEWORDER’s automated AI red teaming covers the complete kill chain from reconnaissance to exploitation. It proactively discovers exploitable vulnerabilities through automated reconnaissance and adversarial testing purpose-built for agentic applications. Static attacks draw from a 300K+ payload library with 100% MITRE and OWASP LLM and Agentic Top 10 coverage, running comprehensive sweeps of known jailbreak patterns, content moderation bypasses, and obfuscation techniques. Dynamic attacks use multi-turn and continuous probing to test how an application holds up across extended adversarial sequences, not just a single interaction. High-agency attacks deploy extremely customised, bespoke attack techniques through probing tailored specifically to the intent and design of each application.
RUNTIME PROTECTION
NEWORDER offers policy enforcement and AI threat protection at the proxy, API, or AI Gateway layer. Protection adapts as the applications evolve and as new capabilities are added. When an attack hits production, whether a jailbreak, a prompt injection, or any other AI threat, it is blocked in real time and an immediate alert is sent with full context, including what happened, which application was targeted, what the impact is, and what to do next. Key performance metrics include 98.6% threat detection accuracy, 1.4% false positive rate, sub-200ms time to detect, sub-50ms real-time blocking, and immediate mean time to respond.
POPIA, section 71
A data subject may not be subject to a decision which results in legal consequences for them, or affects them to a substantial degree, where that decision is based solely on the automated processing of personal information intended to provide a profile. The consequence for an agent estate: a chain of four agents is still solely automated processing. Adding steps does not add a human. If no person exercised judgement on the outcome, section 71 does not care how many machines were involved, and “a human approved the workflow” is not the same as a human deciding the case.
The section 71 exemptions are narrow. Where processing is necessary for a contract or authorised by law, you must still take suitable measures to protect the data subject’s legitimate interests, including an opportunity to make representations. The consequence: if you cannot explain which agent concluded what, and on what basis, you cannot give a data subject a meaningful opportunity to contest it.
POPIA, sections 19 to 21
Security safeguards require reasonable measures to identify foreseeable risks and prevent unlawful access. Operator provisions bind third parties processing on your behalf under written contract, and an operator does not transfer your liability. The consequence: an external agent taking instructions from yours is processing on your behalf, so its authorisation model is your control and your contract needs to say so.
Joint Standard 2 of 2024,
in force 1 June 2025 for banks, insurers, asset managers, retirement funds and credit rating agencies. The board is ultimately accountable under a board-approved cyber risk charter. The standard requires documented evidence of control testing including simulated incidents, a maintained testing calendar, and third-party controls equivalent to your own. The consequence: equivalent means knowing how a third party’s agent authenticates to yours, and a simulated incident that never crosses an agent-to-agent boundary has not tested the workflow you run.
King V,
effective for financial years beginning on or after 1 January 2026, holds the governing body accountable for the effective, compliant and ethical use of technology, with demonstrable accountability for decisions, actions, outputs and outcomes, and human oversight and override proportionate to risk. The consequence: override is a technical capability, not a policy statement. If nobody can halt a running chain mid-execution, you do not have an override mechanism, you have an intention.
QUESTIONS TO ASK BEFORE YOUR NEXT AGENT GOES LIVE
- Draw the graph: which agents can instruct which, and who approved each of those edges?
- When an agent receives an instruction, how does it establish which agent sent it, on whose behalf, and whether that agent was entitled to ask?
- Are any agents sharing a service account or a token, and if so, how would we attribute an action afterwards?
- Can an assertion made in customer-supplied content travel the chain and arrive at a decision agent as an internal fact?
- Which outcomes here have legal or substantial effect on a person, and where does a human exercise judgement rather than approve a design?
- Can a named person stop a running chain mid-execution today, and when did we last test that?
FREQUENTLY ASKED QUESTIONS
FAQ
Does POPIA section 71 apply if several agents were involved rather than one model?
Yes. Section 71 restricts decisions based solely on automated processing that have legal consequences or substantially affect a person. The number of steps is irrelevant. A chain of agents instructing each other is still automated processing, and human involvement means a person exercising judgement on the outcome, not one who approved the workflow months ago.
Was Salesloft Drift an AI failure or an integration failure?
An integration failure with AI consequences. In August 2025 attackers stole OAuth and refresh tokens belonging to an AI chat agent and used them to reach connected customer relationship systems, with fourteen companies publicly confirming impact. The model was never touched. The controls that help are token scope, token lifetime and integration visibility.
How do we authenticate one agent to another properly?
Give each agent a distinct identity rather than a shared service account. Scope tokens to the tools and data the task needs, keep lifetimes short, and carry task context so a receiver can check the request against what the requester was authorised to start. Log the instruction, the sender and the authority, not just the outcome.
WHERE TO GO FROM HERE
- Start at the hub, The OWASP Agentic Top 10 for South Africa, which carries the full regulatory mapping table across all ten risks.
- Book an AI Exposure Review. You get a full agent inventory, an identity and permissions picture, and one live adversarial test against one production agent, so you can see this for yourself.
TAKE ACTION
TEST IT BEFORE SOMEBODY ELSE DOES
Thirty minutes on your agent estate and what this risk looks like in your environment.